SBX payload-version gate over-fires on dev-only lockfile changes

[SUaDtL]

Surfaced while vetting dependabot #418.

Behavior

The [GATE] | [SBX] | Payload version job (.github/workflows/ci.yml ~L736-787) path-scopes to plugins/ca-sandbox wholesale. Any diff under that path counts as a shipped-payload change, so a dev-only plugins/ca-sandbox/tools/package-lock.json bump demands a manifest version advance plus a CHANGELOG heading — describing a change no installed user can observe.

The gate fired correctly on #418 pre-rebase: its head sat on a base where ca-sandbox was 0.1.3, and ca-sandbox-v0.1.3 is a published tag. That is the gate working as designed.

Why it is still worth fixing

#418 passed only incidentally — main had already moved to 0.1.5 via #429, and no ca-sandbox-v0.1.5 tag exists yet. The moment ca-sandbox-v0.1.5 is tagged, the next dev-only dependabot lockfile PR fails this gate again and demands a meaningless version bump.

That is a recurring tax with a worse second-order effect: it trains contributors to bump versions to silence a gate, which is precisely the habit the gate exists to prevent. A version bump should mean "installed users need this", and routine noise erodes that meaning.

Scope note

The same reasoning likely applies to plugins/ca/tools/package-lock.json (ca) — worth checking whether the CA gate has the identical shape.

Suggested direction

Exclude the non-shipped dev surface from the gate's diff scope — at minimum plugins/*/tools/package-lock.json, and arguably plugins/*/tools/** except the committed build artifacts (sandbox.js, farm.js), which ARE shipped and must keep triggering it.

Acceptance criteria

• AC-1: A dev-only lockfile change under plugins/*/tools/ does not require a manifest bump.
• AC-2: A change to a committed build artifact (sandbox.js, farm.js) or to any genuinely shipped payload file still does.
• AC-3: A contract test pins both directions, so the exclusion cannot silently widen.