ci: keep the checkout so the path filter can skip non-client pushes

The job's path filter needs the last build's checkout to compare against.
The pipeline deleted the whole workspace after each run, so Jenkins polled
with "Working Directory does not exist", assumed changes, and started a
run for every push (builds #6 and #7: zero changed files). Delete only
out/ and quest-work/ instead.

Jenkinsfile

@@ -226,10 +226,15 @@ pipeline {
       archiveArtifacts artifacts: 'out/downloads/**', allowEmptyArchive: true, fingerprint: true
     }
     cleanup {
-      // Runs after archiving. Keeps the restic cache and restored stock
-      // builds ($DORKNET_CACHE on the agent, outside the workspace); drops
-      // the workspace's build output and scratch.
-      cleanWs(deleteDirs: true, notFailBuild: true)
+      // Runs after archiving. Drops the build output and scratch (several
+      // GB) but keeps the Git checkout: the job's path filter compares
+      // pushes against it, and without a workspace Jenkins treats every
+      // push as a change and starts a run. The restic cache and restored
+      // stock builds live outside the workspace ($DORKNET_CACHE).
+      cleanWs(deleteDirs: true, notFailBuild: true, patterns: [
+        [pattern: 'out/**', type: 'INCLUDE'],
+        [pattern: 'quest-work/**', type: 'INCLUDE'],
+      ])
     }
   }
 }