bug48: apply the trivial-changes path filter to approved-PR builds too

The changes job used dorny/paths-filter without an explicit base/ref, so on
a pull_request_review event (which, unlike pull_request, is not auto-detected
by the action) it diffed against the default branch with a shallow clone and
treated every file as changed. A docs-only PR therefore ran a full build and
hit the deployment-review gate needlessly.

Diff the PR head (github.event.pull_request.head.sha) against the PR base
(github.event.pull_request.base.sha) explicitly, fetch full history so the
merge-base resolves, and grant pull-requests: read. Push and workflow_dispatch
behavior is unchanged (base/ref fall back to empty, fetch-depth to 1).

Assisted-By: Claude Opus 4.8

.github/workflows/release.yml

@@ -32,7 +32,10 @@ on:
 jobs:
   # The "changes" job will cause the "build" job to get skipped for trivial changes
   changes:
-    permissions: {}
+    # pull-requests: read lets dorny/paths-filter diff via the REST API on the
+    # PR path; the empty default would make it treat everything as changed.
+    permissions:
+      pull-requests: read
     # Only run for push, manual dispatch, or a PR review that is an approval.
     # A non-approving review (comment / changes-requested) must not trigger a build.
     if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'approved' }}
@@ -43,12 +46,20 @@ jobs:
       - uses: actions/checkout@v4
         with:
           # On an approving review, evaluate the filter against the reviewed PR
-          # head commit rather than the base branch.
+          # head commit rather than the base branch. fetch-depth: 0 gives the
+          # filter the history it needs to find the merge-base; without it the
+          # shallow clone has no common ancestor and every file counts as added.
           ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: ${{ github.event_name == 'pull_request_review' && '0' || '1' }}
           persist-credentials: false
       - id: filter
         uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
         with:
+          # pull_request_review is not a pull_request event, so the action does
+          # not auto-detect the PR base. Diff the PR head against the PR base
+          # explicitly so a docs-only PR is correctly seen as no code change.
+          base: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.base.sha || '' }}
+          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || '' }}
           filters: |
             code:
               - '!wiki/**'