ci: re-run catalog previews when the containment module changes

Rames' non-blocking note on #2975. The paths filter listed the renderer but not
scripts/registry-target-paths.mjs, which it imports — so a future change to the
path-traversal defence alone would never re-run the only job that exercises it.

That is the same shape as the bug the module exists to prevent: the check is
present, the thing that would catch a regression in it is not wired to run.

Author: ukimsanov

.github/workflows/catalog-previews.yml

@@ -15,6 +15,9 @@ on:
       - "registry/blocks/**"
       - "registry/components/**"
       - "scripts/generate-catalog-previews.ts"
+      # The containment module the renderer imports. Without it a change to
+      # path-traversal defence alone never re-runs the job that exercises it.
+      - "scripts/registry-target-paths.mjs"
       - ".github/workflows/catalog-previews.yml"
 
 concurrency: