ci: include bundled data files in publish paths filter, add workflow_dispatch

The publish job uses a path filter to skip on docs-only changes, but the
filter was excluding two files that ARE bundled into the container image
via the Dockerfile:

- tercet_missing_codes.csv (estimates fallback table)
- docker-entrypoint.sh (the actual ENTRYPOINT)

Consequence: PR #93 (CSV-only data update) was merged but `publish`
skipped, so `ghcr.io/.../:latest` still pointed at the previous image
without the 38 new postcodes and the LT 71205 fix. Same risk applies to
any future entrypoint-only change.

Adds both files to the `code:` filter so a fresh image is published on
merge. Also adds `workflow_dispatch` so the publish flow can be
re-triggered manually from the Actions UI (or `gh workflow run`) without
needing an empty commit dance; updates the `publish` job's `if` to allow
that event type as well.

Side effect of this PR landing: triggers a fresh image build that picks
up #93's CSV update, so the next bunny.net redeploy from `:latest` will
ship both the v0.19.3 deps and the data update.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bk86a

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch: {}
 
 permissions:
   contents: read
@@ -13,10 +14,14 @@ permissions:
 
 jobs:
   # Detect whether the change touches any code-relevant path.
-  # Docs-only changes (README, *.md, *.csv, docs/**) skip heavy work
-  # while every required check name still reports success — this avoids
-  # the paths-ignore + required-status-checks deadlock that previously
-  # blocked docs-only PRs.
+  # Docs-only changes (README, *.md outside the repo root data files,
+  # docs/**) skip heavy work while every required check name still
+  # reports success — this avoids the paths-ignore + required-status-checks
+  # deadlock that previously blocked docs-only PRs.
+  #
+  # Data files bundled into the container image (tercet_missing_codes.csv,
+  # docker-entrypoint.sh) ARE code-relevant — a change to either affects
+  # what ships in `ghcr.io/.../:latest`, so they belong in the filter.
   changes:
     runs-on: ubuntu-latest
     outputs:
@@ -36,6 +41,8 @@ jobs:
               - 'pyproject.toml'
               - 'Dockerfile'
               - 'Makefile'
+              - 'docker-entrypoint.sh'
+              - 'tercet_missing_codes.csv'
               - '.github/workflows/**'
 
   lint:
@@ -126,7 +133,7 @@ jobs:
         run: echo "Docs-only change — skipping docker build."
 
   publish:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.code == 'true'
+    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' && needs.changes.outputs.code == 'true'
     needs: [changes, lint, import-check, test, security, docker]
     runs-on: ubuntu-latest
     steps: