ci: scope workflows to avoid redundant docs deploys and benchmark runs

- docs.yml: remove semantica/** path trigger (was deploying docs on every
  source code push); add release:[published] so docs still deploy on releases
- benchmark.yml: remove pull_request trigger (heavy deps - torch/spacy/faiss);
  add paths-ignore for doc-only main pushes; add workflow_dispatch for manual runs
- ci.yml: add paths-ignore so doc-only changes skip build; add pytest step
  so tests actually run in CI (was build-only before)
- security-scan.yml: add paths-ignore on push/pull_request; schedule runs unaffected

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/benchmark.yml

@@ -2,9 +2,13 @@ name: Semantica Performance Suite
 
 on:
   push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
+  workflow_dispatch:
 
 jobs:
   performance-test:

.github/workflows/ci.yml

@@ -3,8 +3,18 @@ name: CI
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
   pull_request:
     branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
 
 jobs:
   build:
@@ -16,3 +26,5 @@ jobs:
           python-version: '3.11'
       - run: pip install build
       - run: python -m build
+      - run: pip install -e ".[dev]"
+      - run: pytest tests/ -x -q

.github/workflows/docs.yml

@@ -8,11 +8,12 @@ on:
     branches: [main]
     paths:
       - 'docs/**'
-      - 'semantica/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
       - 'CHANGELOG.md'
       - 'RELEASE.md'
+  release:
+    types: [published]
   workflow_dispatch:
 
 # Permissions needed to deploy to GitHub Pages

.github/workflows/security-scan.yml

@@ -4,9 +4,19 @@ on:
   schedule:
     - cron: '30 1 * * 1,4'  # Mon/Thu 7 AM IST
   push:
-    branches: [ main ]
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
   pull_request:
-    branches: [ main ]
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
 
 jobs:
   security-scan: