fix(ci): catch an unbumped desktop change on the PR, not on main

[catomean]

Today a dependabot bump turned main red and stopped the merge queue. The gate was right; its timing was racy, and the race is the whole bug.

What happened, in order

#482 merges, mints fleet-runner-v0.8.16.

#411 (dependabot, touches ONLY desktop/package-lock.json) had already run
     its CI while v0.8.15 was newest. Against v0.8.15 its base ALREADY read
     0.8.16, so "version is ahead of released" held — CI PASSED.

#411 merges. Newest tag is now v0.8.16, the only desktop change since it is
     that lockfile, and the identical check goes RED on main.

Both evaluations were correct. The gap is between them — and everyone else pays: the sweep merges nothing onto a red base, so every unrelated PR stalls behind a bot's dependency bump. #483 failed CI on a diff that touched no desktop file at all.

The fix

The existing question is cumulative — "has anything changed since the last tag" — and its answer moves when a tag is minted, i.e. for reasons outside the branch. So ask a second question that has no race in it:

does the diff of this branch touch desktop/, and if so does this branch bump desktop/package.json?

Decided entirely within the branch, identically before and after any tag appears. It fires on the PR — one blocked bot PR a human can see — instead of after the merge, where it's a red main and a stopped queue.

On main itself the branch diff is empty and the rule doesn't apply; the cumulative check still guards there.

Mutation-proven

state	result
desktop change, no bump	exit 1 — "this branch changes desktop/ but does not bump desktop/package.json", naming the file
+ bump, no changelog entry	exit 1 on the pre-existing changelog rule — the two compose; a bump alone still isn't publishable
neither	passes; rule correctly silent

The first row is exactly the shape of #411.

Why this and not the automation

I'd offered to have the sweep open the bump PR itself. This is better: opening a PR after the fact repairs the outage; this prevents it.

pnpm run verify passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UvjGNAS9CMfEGNW26tUR4P