The check now triggers on every PR so it can be a required status: the detect job
selects the touched e2e test files and skips the run job when there are none,
and a PR that touches only the harness or the stack runs access_control as a
smoke. The run job repeats the selection three times with reruns off, so a
flaky test fails here instead of at the release gate.
The run job references the e2e-changed environment, which lets required
reviewers gate every run before it can mint OIDC credentials, and it reads
dedicated litellm-e2e-changed-* secrets instead of the stage ones. Stack logs
are no longer uploaded as a public artifact; the masked job log keeps the tail.
up.sh generated a CA without keyUsage or basicConstraints, which Python 3.13's
strict certificate verification rejects, so every gateway died at Redis connect.
The CI config moves to tests/e2e/gateway/stage_mirror_ci_config.yml so it no
longer collides with the untracked local litellm-config.yml.
