Two review findings on the first two commits. The two jobs no longer decide separately. Build-and-ng-test now publishes `client` as a job output and Build-and-test-development consumes it instead of re-diffing the base branch: a base commit landing between the two decisions could make the Cypress job expect an artifact the build job had already skipped, and the failure would read as a missing artifact. An empty output (the build job could not decide) still runs everything. The path list is now a PATHS variable the script can be asked about directly (`--match` with a file list on stdin), and tests/cypress-changes.test.sh pins one case per alternative plus the negatives (a sas/ service, docs, the Lighthouse workflow, a "clientx/" directory, the sas lockfile). The build job runs the test, so dropping an alternative is red rather than a suite that silently stops covering a class of change. Checked the test fails when the pattern is mutated.