ci: carve out private/cockpit + terraform/credentials/cockpit from filename-linter

The fork's filename-linter (inherited from upstream pixie-io) rejects
any PR diff that touches a path containing 'private'. The restored
fork-cloud config from the main-merge fix (cb81ecd) added 12
private/cockpit/* + 1 terraform/credentials/cockpit/* files, which
upstream-main had deleted via PR pixie-io#2391 — the linter then correctly
saw them as 'new private/* additions' and failed.

These specific paths are LEGITIMATE fork-cloud deployment config that
pre-dates the upstream linter; the original 'no private/* leaks'
intent stays in place for everything else via two negative-glob
exceptions.

Author: entlein

.github/workflows/filename_linter.yaml

@@ -18,10 +18,19 @@ jobs:
     - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36  # v3.0.2
       id: changes
       with:
+        # Fork carve-outs: private/cockpit/ + terraform/credentials/cockpit/
+        # are LEGITIMATE fork config for the AOCC pixie-cloud deployment;
+        # they were on the fork before upstream main introduced
+        # filename_linter and stayed when the cert-manager migration
+        # (#2391) deleted them upstream. Negative-globbing them keeps
+        # the original "no private/* leaks" guard while letting the
+        # fork's known-private deployment files through.
         filters: |
           private:
           - '**/*private*/**'
           - '**/*private*'
+          - '!private/cockpit/**'
+          - '!terraform/credentials/cockpit/**'
     - name: Fail on private
       if: ${{ steps.changes.outputs.private == 'true' }}
       run: echo "This repo disallows dirnames or filenames with 'private' in it." && exit 1