ci: scope workflows to avoid redundant docs deploys and benchmark runs

- docs.yml: remove semantica/** path trigger (was deploying docs on every
  source code push); add release:[published] so docs still deploy on releases
- benchmark.yml: remove pull_request trigger (heavy deps - torch/spacy/faiss);
  add paths-ignore for doc-only main pushes; add workflow_dispatch for manual runs
- ci.yml: add paths-ignore so doc-only changes skip build; add pytest step
  so tests actually run in CI (was build-only before)
- security-scan.yml: add paths-ignore on push/pull_request; schedule runs unaffected

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/benchmark.yml

@@ -2,9 +2,13 @@ name: Semantica Performance Suite
 
 on:
   push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-docs.txt'
+      - '*.md'
+  workflow_dispatch:
 
 jobs:
   performance-test: