docs(backlog): WP-30 status update — 5 of 6 items landed

Records what's implemented (items 1/3/4/5/6), what's deliberately skipped
this round (item 2, blocked on act_runner access), and that the WP can't be
marked fully done until a real Gitea run confirms the CI-timing/path-filter
behavior this environment can't observe. npm run ci confirmed green locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -50,7 +50,7 @@ Gates land before the work they cover; each lint rule lands in the same WP as th
 for its existing violations, so every WP ends green.
 
 | WP                                                     | Title                                                                              | Phase                       | Status      |
-| ------------------------------------------------------ | ---------------------------------------------------------------------------------- | --------------------------- | ------ |
+| ------------------------------------------------------ | ---------------------------------------------------------------------------------- | --------------------------- | ----------- |
 | [WP-01](WP-01-axe-ci-gate.md)                          | Axe-on-every-story CI gate                                                         | 0 · gates                   | done        |
 | [WP-02](WP-02-check-tokens.md)                         | Harden `check:tokens` + fix what it catches                                        | 0 · gates                   | done        |
 | [WP-03](WP-03-contracts-purity.md)                     | Boundaries I: contracts purity + ApiClient confinement                             | 0 · gates                   | done        |
@@ -80,7 +80,7 @@ for its existing violations, so every WP ends green.
 | [WP-27](WP-27-brief-ux-layer.md)                       | Brief UX layer (undo/redo, standaardbrief, diff)                                   | 6 · Brief v2                | done        |
 | [WP-28](WP-28-brief-v2-demo-polish.md)                 | Brief v2 demo polish (scenarios, e2e, docs)                                        | 6 · Brief v2                | done        |
 | [WP-29](WP-29-stamdata-beheer-editor.md)               | Stamdata beheer editor (low-code, PR-emitting)                                     | follow-on · ADR-0004        | done        |
-| [WP-30](WP-30-ci-perf-followups.md)                    | CI performance follow-ups (node_modules cache, runner image, path filters)         | follow-on · CI/infra        | todo   |
+| [WP-30](WP-30-ci-perf-followups.md)                    | CI performance follow-ups (node_modules cache, runner image, path filters)         | follow-on · CI/infra        | in-progress |
 | [WP-31](WP-31-shared-store-helpers.md)                 | Shared store helpers (ActionState/SaveState, history, debounced-save, RemoteData)  | 7 · refinements             | done        |
 | WP-32                                                  | Undo/redo in the stamdata editor (folded into WP-31 — no separate file)            | 7 · refinements             | done        |
 | [WP-33](WP-33-dev-switchers.md)                        | In-app dev switchers (scenario + role)                                             | 7 · refinements             | done        |

docs/project/backlog/WP-30-ci-perf-followups.md

@@ -1,6 +1,7 @@
 # WP-30 — CI performance follow-ups
 
-Status: todo
+Status: in-progress (5 of 6 items implemented + committed; pending a real Gitea run to confirm —
+see "Status update" below)
 Phase: follow-on · CI/infra
 
 ## Why
@@ -51,11 +52,37 @@ runner image, set on the act_runner host).
    tighter ruleset than `p/default` if the GitHub-Actions-policy rules aren't wanted), then add
    `--error` to `semgrep scan` so it's a real gate.
 
+## Status update (2026-07-30)
+
+Items 1, 3, 4, 5, 6 implemented, each as its own commit (item 6 `526da76`, item 1 `e46b87b`,
+item 4 `e02e8ce`, item 3 `e7db69d`, item 5 see `git log -- backend/Dockerfile`): triaged real
+local semgrep findings (25, not the 27 this
+file remembered — dependabot cooldown, npm min-release-age, every GH Action pinned to SHA, 2
+nosemgrep'd ReDoS false positives) and flipped the gate to `--error`; `node_modules` cache
+(skips `npm ci` entirely on a hit) across all 4 npm jobs; a new fast-fail `lint` job split out
+of `frontend`; a `changes` job (`dorny/paths-filter`) gating every downstream job's real steps
+(not the whole job — the safer "skip steps" variant, so a required-status-check never waits on
+a job that never ran) on which side changed; an optional `backend/Dockerfile` +
+`docker-compose.prod.yml` (additive, unused by CI or the dev demo).
+
+**Item 2 (smaller runner image) deliberately skipped this round** — the real fix needs
+act_runner admin access (unconfirmed), and the repo-only partial (`node:24-slim` on
+`frontend`/`storybook-a11y`) conflicts with `storybook-a11y`'s deliberately-chosen
+`node:24-bookworm` + memory-cap container (verified against a real OOM risk). Revisit once
+act_runner access is confirmed.
+
+**Cannot self-certify GREEN**: per this WP's own constraint, CI timing/behavior isn't
+observable from the agent's environment. Everything above was checked as far as locally
+possible (YAML parse, `actionlint` 0 issues, `npm run ci`, a real `docker build`) but the actual
+speedup and the path-filter's interaction with any required-status-check config need a watched
+Gitea run before this WP can be marked fully `done`.
+
 ## Acceptance criteria
 
 - [ ] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
       from the agent env), landed as its own revertable commit.
-- [ ] `npm run ci` still passes locally after any workflow/script change.
+- [x] `npm run ci` still passes locally after any workflow/script change (confirmed 2026-07-30,
+      full run including backend `dotnet test`/`dotnet format` and both drift checks).
 
 ## Out of scope