ci: skip Docker builds for README and repository images

[KraHsu]

Changes limited to README.md and assets/repo_images/** currently trigger a full CUDA image build. Add paths-ignore filters for pull requests and branch pushes so these presentation-only updates skip Docker CI; mixed changes containing other files still run it. Version-tag pushes and manual dispatch remain enabled. Validation: YAML parsing, event-filter assertions, and git diff --check passed. Docker build-and-test is not a required main branch check.

[wayrise]

Approving. I verified the three things that could have made this change unsafe, and all of them hold.

1. No merge deadlock from a skipped check. The effective ruleset on main (require-pr-review, including org-level rules) requires only lint and tests, both from ci.yml. Docker build and tests is not a required context, so a README-only PR that never starts this workflow stays mergeable rather than hanging on a check that will never report. Worth keeping in mind as a standing constraint: if build-and-test is ever promoted to a required check, these paths-ignore filters have to be replaced with a skip-job that reports success, or such PRs will block forever. Relatedly, ci.yml correctly has no path filters — please keep it that way.

2. Version-tag pushes really do still build. This is right, though for a subtler reason than the description implies: GitHub does not evaluate paths/paths-ignore for tag pushes at all — the filters are silently ignored on that ref type (community discussion #165354). So tags: ['v*'] builds fire unconditionally, which is the desired behavior here. It is not that the tagged commit happens to touch non-ignored files.

3. The ignored paths genuinely cannot affect the image. I checked both against docker/Dockerfile.dockerignore rather than assuming:

• assets/repo_images/** is excluded from the build context entirely. Line 2 ignores **, and the only re-includes under assets/ are openwam_usage_docs/** and robodojo_verification/**. So those 8.3 MB of PNG/JPG never reach COPY . . and provably cannot change the image. Good call scoping this to repo_images instead of all of assets/ — ignoring assets/** would have wrongly skipped openwam_usage_docs/, which ships in the image and in the offline bundle's CONFIG_FILES.
• Root README.md is re-included (!README.md), so it is copied into the image. Strictly, a README-only change does alter image contents and this workflow will no longer rebuild it. That is fine in practice: nothing in docker-check or docker-integration-check reads the root README (make all only lints openwam/ scripts/ tests/ docker/), and the next substantive change rebuilds it anyway. Flagging it only because "presentation-only" is not literally true for this one path.

Pattern depth is correct. README.md is anchored at the repo root, so docker/README.md still triggers a build — which matters, since it is a schema-3 offline-bundle config file asserted on in tests/docker/test_docker_tools.py. benchmarks/README.md and assets/robodojo_verification/README.md likewise still build. A **/README.md pattern here would have been a real bug.

I confirmed the filter behavior by evaluating the two patterns against representative changed-file sets (README-only, image-only, both, and the mixed case) — mixed changes still build, as claimed — and re-ran the suite on the branch in a clean env: 2009 passed, 13 skipped, exit 0. git diff --check is clean and both workflow files parse.

Optional, non-blocking: CONTRIBUTING.md and CITATION.cff are also outside the Docker build context and would be equally safe to add later if they start churning.