ci(R-1297 A): heavy suites by path on a branch push, all on a tag and nightly; no second full gate run

- script_tests_gate.py: test_gate_decoys / test_due_checks_gate / dooplex-offsite run on a CI branch push only
  when one of their paths changed (FELHOM_CHANGED_FILES); no list, an empty or unreadable list = every suite
- gates.yml: nightly schedule 03:20 UTC; the list is set only for push:refs/heads/*; a trimmed commits array
  (total_commits > listed) is an unknown list
- test_repo_gates.py and test_due_checks_gate.py group G drive the real runner with GATES narrowed to their
  labels, instead of the whole gate set a second time (130 s each in CI)
- red-proved: filter cases, workflow pins (old gates.yml), inert run_gate, unregistered due-checks

.gitea/workflows/gates.yml

@@ -18,8 +18,13 @@
 name: gates
 # R-1129: `workflow_dispatch` is the manual PROOF that the failure mail can be sent. A push run is
 # unchanged by it: the proof step below is skipped on a push, and `force_alarm` is then empty.
+# R-1297 (A, 2026-10-26): the nightly schedule is the run that still executes the three path-filtered suites when no
+# push touched their files (scripts/script_tests_gate.py PATH_FILTERED). It sets no file list, so every suite runs —
+# like a release tag (a tag push) and a manual dispatch. 03:20 UTC: after the 01:40 release copy and the night chain.
 on:
   push:
+  schedule:
+    - cron: "20 3 * * *"
   workflow_dispatch:
     inputs:
       force_alarm:
@@ -149,6 +154,12 @@ jobs:
           if not commits:
               sys.stderr.write("the payload carries no commits array - unknown\n")
               raise SystemExit(0)
+          # R-1297: Gitea trims the payload's commits array (the newest few only); a push of more commits than it
+          # lists has files nobody named here. That list is UNKNOWN, never short - so nothing is printed.
+          total = ev.get("total_commits")
+          if isinstance(total, int) and total > len(commits):
+              sys.stderr.write("the payload lists %d of %d commits - the file list is unknown\n" % (len(commits), total))
+              raise SystemExit(0)
           seen = []
           for c in commits:
               for key in ("added", "modified", "removed"):
@@ -172,6 +183,18 @@ jobs:
           [ "$SCOPE" = "docs" ] || SCOPE=code
           echo "PUSH_SCOPE=$SCOPE" >> "$GITHUB_ENV"
           echo "scope: $SCOPE"
+          # R-1297 (A): the heavy suites read this list and skip themselves when none of their paths changed. ONLY a
+          # branch push with a known list sets it; a tag, the nightly schedule and a dispatch run every suite.
+          case "${GITHUB_EVENT_NAME:-}:${GITHUB_REF:-}" in
+            push:refs/heads/*)
+              if [ -s /tmp/pushed-files.txt ]; then
+                echo "FELHOM_CHANGED_FILES=/tmp/pushed-files.txt" >> "$GITHUB_ENV"
+                echo "suite filter: ON (a branch push with a known file list)"
+              else
+                echo "suite filter: OFF (no usable file list) - every suite runs"
+              fi ;;
+            *) echo "suite filter: OFF (${GITHUB_EVENT_NAME:-?} ${GITHUB_REF:-?}) - every suite runs" ;;
+          esac
 
       - name: Run the gate entry point
         # The ONLY thing CI runs. No go build, no go test, no linting, no deploy — those are either