fix(validate.yml): rootfs/ base-input detection (anchored-group regex bug)

The detect step's regex '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$' anchored
the whole alternation with a trailing $, so the rootfs/ branch only matched a
file literally named 'rootfs/' — never real paths like
rootfs/usr/local/lib/opencode-devbox/generate-config.py (which Dockerfile.base
COPYs into the base). Result: rootfs-only base changes set base_changed=false and
validate-base/validate-omos ran against the stale base-latest instead of skipping
(observed live: run 429, my own generate-config.py commit, did not skip).

Fix: compute the match once into $changed with rootfs/ as a PREFIX
('^(Dockerfile\.base$|rootfs/|entrypoint.*\.sh$)') and gate on -n; reuse it for
the file listing so the two greps can't drift. Bug predates the skip feature
(introduced in dba05da); the skip in 703edbe made it load-bearing.

actionlint clean; detect logic simulated across rootfs/Dockerfile.base/entrypoint/
docs-only change-sets.

CHANGELOG.md

@@ -35,7 +35,11 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
   The `base-change-warning` job now exports a `base_changed` output and those two
   jobs **skip** when base inputs changed, deferring full base validation to the
   release path (`docker-publish-split.yml`). The scary red becomes a neutral skip
-  plus the existing warning.
+  plus the existing warning. Also fixes the base-input detector itself: its
+  `^(…|rootfs/|…)$` regex anchored the whole alternation, so the `rootfs/` branch
+  only matched a file literally named `rootfs/` and never real paths like
+  `rootfs/usr/…/generate-config.py` — `rootfs/` is now a prefix match, so
+  rootfs-only base changes are detected too.
 
 ---