ci: scope workflows to avoid redundant docs deploys and benchmark runs

- docs.yml: remove semantica/** path trigger (was deploying docs on every
  source code push); add release:[published] so docs still deploy on releases
- benchmark.yml: remove pull_request trigger (heavy deps - torch/spacy/faiss);
  add paths-ignore for doc-only main pushes; add workflow_dispatch for manual runs
- ci.yml: add paths-ignore so doc-only changes skip build; add pytest step
  so tests actually run in CI (was build-only before)
- security-scan.yml: add paths-ignore on push/pull_request; schedule runs unaffected

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/docs.yml

@@ -8,11 +8,12 @@ on:
     branches: [main]
     paths:
       - 'docs/**'
-      - 'semantica/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
       - 'CHANGELOG.md'
       - 'RELEASE.md'
+  release:
+    types: [published]
   workflow_dispatch:
 
 # Permissions needed to deploy to GitHub Pages