chore(ci): skip refresh-counts PR when only timestamps changed

[amavashev]

Summary

Follow-up to PR #604. The unified refresh-counts.yml opens a PR every day at 06:00 UTC; when no count actually moves between runs, the diff is just a fetchedAt bump (update-github-counts.mjs writes the timestamp unconditionally on line 254). PR #605 today hit exactly this case — 1 file / +1/-1 line, only fetchedAt changed, closed without merging because nothing material was captured.

What changed

.github/workflows/refresh-counts.yml step 3:

• Pull the textual diff for both watched files via git diff --no-color --
• Filter to real change lines: ^[+-][^+-] excludes the +++ b/path / --- a/path file-header lines
• Drop any change lines that touch only fetchedAt or lastVerifiedAt
• Open a PR only if material change lines remain

The data fetch in steps 1–2 still runs unconditionally — fresh data always pulled, HWM cursors still advance, only the noise PR is suppressed.

Why filter both fetchedAt and lastVerifiedAt

installs-cache.json carries fetchedAt (ISO-8601 datetime, set on every successful update-github-counts.mjs run, line 254). manual-package-counts.json carries lastVerifiedAt (date-only YYYY-MM-DD, set whenever the GHCR sub-step succeeds, line 263). Both are pure freshness indicators — neither carries data anyone reads. Filtering both covers the no-op-refresh case for both files.

Verification

Tested the filter regex against three synthetic diffs locally:

=== Test 1: timestamp-only diff (should skip) ===
material lines: []
→ would skip PR (correct)

=== Test 2: real count change + timestamp (should open) ===
material lines:
-  "npm": 4639,
+  "npm": 4700,
-  "total": 11209,
+  "total": 11270,
→ would open PR (correct)

=== Test 3: lastVerifiedAt only (should skip) ===
material lines: []
→ would skip PR (correct)

YAML re-parsed cleanly via the yaml package — 5 steps, unchanged structure.

Failure modes considered

• Timestamp value contains the substring fetchedAt: not possible — the timestamps are ISO datetime / date strings, no field-name contamination.
• total changes but no individual count did: not possible — cache.total = Math.max(npm + pypi + crates + releases + ghPackages + maven, cache.total) (script line 251–253). If all components are unchanged, newTotal is unchanged, total stays at its existing value.
• JSON key reordering producing spurious diff lines: not possible — JSON.stringify preserves insertion order, and the script only mutates values, never reorders.
• Non-fetchedAt change on the same line as fetchedAt: not possible — pretty-printed JSON puts each field on its own line.

Test plan

• YAML parses, 5 steps, structure unchanged
• Filter regex verified against three synthetic diff cases (timestamp-only-skip / count-change-open / lastVerifiedAt-only-skip)
• Live test: trigger workflow_dispatch shortly after merge to confirm a no-op refresh produces the "skipping PR" log line and no PR
• Live test: when registry counts grow on a real day, confirm a PR with the expected small diff is still opened