ci(workflows): align paths with post-rewrite layout + lock against drift

feat(ci): Sprint A1 — Hardening CI (B-7, B-8, M-4, M-15, m-7, m-8, m-9)