ci: the deriver is in the file sets but was not in the path filters

`85ead4d` changed `packaging/version.sh` — the script that decides what every
artifact claims to be — and the desktop and Android lanes did not run at all.
Only CI & Build fired, and only because it happens to watch `tests/**`.

So the fix in that commit is unverified on exactly the two lanes whose bug it
was fixing.

`version.sh` lists `packaging` in all three file sets; the workflows' `paths:`
filters did not. Two places holding one decision, with one of them updated —
the failure this subsystem keeps producing (#2181-2183, and again in step 3
where `install.sh` still expected stable's bundles on a versioned release).

The script's own header already warned about this: "a change here that is not
mirrored there means a lane that does not fire — check both." Written, then
not followed, in the same commit.

Step 6 removes the duplication for real by replacing these filters with
skip-if-exists. This is the stopgap until then, and it says so at each site.

#3144

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.forgejo/workflows/android.yml

@@ -27,6 +27,9 @@ on:
       - "core/**"
       - "Cargo.toml"
       - "Cargo.lock"
+      # The version deriver — see the note in desktop.yml. This lane did not run on
+      # 85ead4d, which changed it.
+      - "packaging/**"
       - ".forgejo/workflows/android.yml"
   workflow_dispatch:
 

.forgejo/workflows/ci.yml

@@ -26,6 +26,8 @@ on:
       - "alembic/**"
       - "alembic.ini"
       - "Dockerfile"
+      # The version deriver — see the note in desktop.yml.
+      - "packaging/**"
       - ".forgejo/workflows/ci.yml"
   # Dispatched by the Android lane once it has published a client, so the image
   # that bakes it in is built AFTER the APK exists rather than racing it. See the

.forgejo/workflows/desktop.yml

@@ -37,6 +37,13 @@ on:
       # of date. Config and lockfile included — a dependency bump changes the bundle
       # as surely as a component does.
       - "frontend/**"
+      # The version deriver. It decides what this artifact CLAIMS to be, so a change
+      # to it is a change to the artifact — and `packaging/version.sh` lists this
+      # same set from the other side. Two places holding one decision, which is why
+      # step 6 replaces these filters with skip-if-exists. Until then: edit one, edit
+      # the other. Learned the direct way — 85ead4d changed the deriver and this lane
+      # did not run at all.
+      - "packaging/**"
       - ".forgejo/workflows/desktop.yml"
   workflow_dispatch: