[groom] Four bump fleets watch their whole asset directory, tests and README included, so a test-only commit fans a churn bump PR across the fleet

**Groom auto-builder** — Comfy-Org/github-workflows: this CONFIRMED finding could not be auto-built (patch modifies a CI-privileged path (per .github/groom/patch_policy.py — workflow/action defs, lockfiles, or build/test config that executes in pre-review CI) — a human must author these changes), so it is filed for a human. · [run](https://github.com/Comfy-Org/github-workflows/actions/runs/32712056525)

## Verified

Fleets whose push paths filter carries the exclusions: bump-area-label (35-36), bump-linear-ticket (41-42), bump-pr-risk (87-88), bump-pr-derisk (106-109), bump-public-repo-hygiene (46-47) - each excluding the tool tests tree and its README.md, with the documented reason that a test-only or docs-only commit would fan a pure-churn SHA-bump PR across the whole fleet. bump-pr-size excludes scripts/check-pr-size/*_test.go with a five-line rationale (that tree has no README). So the comparison set is five fleets excluding tests+README and one excluding tests only - the finder said six excluding exactly those paths, which is close but not exact.

Fleets that have an asset directory and NO exclusion:

* bump-agents-md-callers.yml:48-50 - .github/agents-md-integrity/**, which contains tests/ and README.md.
* bump-coderabbit-config-callers.yml:60-62 - .github/coderabbit-config/**, same.
* bump-groom-callers.yml:58-65 - .github/groom/**, whose tests/ holds 9 files.
* bump-cursor-review-callers.yml:56-72 - inconsistent inside one file: it excludes scripts/check-pr-size/*_test.go but pulls in .github/cursor-review/** (which contains tests/ and README.md) with no exclusion.

The remaining three fleets (auto-label, detect-unreviewed-merge, assign-reviewers) watch a workflow file only and are out of scope.

## Impact (counterfactual)

A tests-only or README-only commit under those directories would start a bump run that mints the org-wide App token, force-resets the fleet stable ci/bump-* branch and opens a review round in every enrolled caller repo for a diff with no consumer-visible behaviour change.

## Fix

Add the two negations to the four filters, and in the SAME change move those fleets preflight inputs across: preflight.sh header is explicit that when a filter carries exclude entries, the bare WATCHED_ASSETS tree-OID comparison reads a test-only commit as changed-since and produces a FALSE stale verdict that freezes the fleet - so these four need WATCHED_PATHSPECS mirroring the filter (exclusions included) plus WATCHED_EXEC, exactly as bump-pr-risk, bump-pr-size and bump-cursor-review already do for their excluded trees. .github/bump-callers/tests/test_paths_contract.sh enforces the mirror in both directions, so a half-done change fails there rather than silently.

## Risk

Low ONLY IF the preflight inputs move at the same time; doing the filter alone is the documented fleet-freeze failure mode. That makes this more than add-two-lines-times-four - treat the pathspec migration as the main body of work.

## Steelman

For groom the exclusion is least obviously right, because .github/groom mixes executed prose (the finder/verifier/builder briefs, which consumers DO run at the pinned SHA) with tests; but that argues for excluding tests/ and README.md specifically, which is exactly the proposal.

Inspect the push-path filters in bump-agents-md-callers.yml, bump-coderabbit-config-callers.yml, bump-groom-callers.yml, and bump-cursor-review-callers.yml, then read preflight.sh to understand the WATCHED_PATHSPECS and WATCHED_EXEC inputs. Run .github/bump-callers/tests/test_paths_contract.sh; done means each filter excludes tests and README.md and its preflight inputs mirror those exclusions without the contract test failing.

由索引模型根据 Issue 内容生成。