docs(backlog): WP-30 status update — 5 of 6 items landed

Records what's implemented (items 1/3/4/5/6), what's deliberately skipped
this round (item 2, blocked on act_runner access), and that the WP can't be
marked fully done until a real Gitea run confirms the CI-timing/path-filter
behavior this environment can't observe. npm run ci confirmed green locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/WP-30-ci-perf-followups.md

@@ -1,6 +1,7 @@
 # WP-30 — CI performance follow-ups
 
-Status: todo
+Status: in-progress (5 of 6 items implemented + committed; pending a real Gitea run to confirm —
+see "Status update" below)
 Phase: follow-on · CI/infra
 
 ## Why
@@ -51,11 +52,37 @@ runner image, set on the act_runner host).
    tighter ruleset than `p/default` if the GitHub-Actions-policy rules aren't wanted), then add
    `--error` to `semgrep scan` so it's a real gate.
 
+## Status update (2026-07-30)
+
+Items 1, 3, 4, 5, 6 implemented, each as its own commit (item 6 `526da76`, item 1 `e46b87b`,
+item 4 `e02e8ce`, item 3 `e7db69d`, item 5 see `git log -- backend/Dockerfile`): triaged real
+local semgrep findings (25, not the 27 this
+file remembered — dependabot cooldown, npm min-release-age, every GH Action pinned to SHA, 2
+nosemgrep'd ReDoS false positives) and flipped the gate to `--error`; `node_modules` cache
+(skips `npm ci` entirely on a hit) across all 4 npm jobs; a new fast-fail `lint` job split out
+of `frontend`; a `changes` job (`dorny/paths-filter`) gating every downstream job's real steps
+(not the whole job — the safer "skip steps" variant, so a required-status-check never waits on
+a job that never ran) on which side changed; an optional `backend/Dockerfile` +
+`docker-compose.prod.yml` (additive, unused by CI or the dev demo).
+
+**Item 2 (smaller runner image) deliberately skipped this round** — the real fix needs
+act_runner admin access (unconfirmed), and the repo-only partial (`node:24-slim` on
+`frontend`/`storybook-a11y`) conflicts with `storybook-a11y`'s deliberately-chosen
+`node:24-bookworm` + memory-cap container (verified against a real OOM risk). Revisit once
+act_runner access is confirmed.
+
+**Cannot self-certify GREEN**: per this WP's own constraint, CI timing/behavior isn't
+observable from the agent's environment. Everything above was checked as far as locally
+possible (YAML parse, `actionlint` 0 issues, `npm run ci`, a real `docker build`) but the actual
+speedup and the path-filter's interaction with any required-status-check config need a watched
+Gitea run before this WP can be marked fully `done`.
+
 ## Acceptance criteria
 
 - [ ] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
       from the agent env), landed as its own revertable commit.
-- [ ] `npm run ci` still passes locally after any workflow/script change.
+- [x] `npm run ci` still passes locally after any workflow/script change (confirmed 2026-07-30,
+      full run including backend `dotnet test`/`dotnet format` and both drift checks).
 
 ## Out of scope