fix: address Qodo review issues in CI workflows

- Replace '*.md' with '**/*.md' in paths-ignore across ci.yml,
  benchmark.yml, and security-scan.yml — '*.md' only matches root-level
  markdown; '**/*.md' covers all subdirectories (cookbook/, docs/, etc.)
- Add cache: 'pip' to setup-python in ci.yml to avoid re-downloading
  heavy packages (torch, spacy, faiss) on every run
- Update security-scan PR comment text to accurately reflect that it
  skips doc/markdown-only PRs, not "every PR"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/benchmark.yml

@@ -7,7 +7,7 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   workflow_dispatch:
 
 jobs:

.github/workflows/ci.yml

@@ -7,14 +7,14 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   pull_request:
     branches: [main]
     paths-ignore:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
 
 jobs:
   build:
@@ -24,6 +24,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
+          cache: 'pip'
       - run: pip install build
       - run: python -m build
       - run: pip install -e ".[dev]"

.github/workflows/security-scan.yml

@@ -9,14 +9,14 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   pull_request:
     branches: [main]
     paths-ignore:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
 
 jobs:
   security-scan:
@@ -168,7 +168,7 @@ jobs:
             }
             
             // Create summary comment
-            const comment = `# 🔒 Security Scan Results\\n\\n${safetyResults}\\n\\n${banditResults}\\n\\n${semgrepResults}\\n\\n---\\n\\n*This security scan runs automatically on every PR and bi-weekly.*\\n\\n📊 **Security Policy**: CI fails on vulnerabilities and HIGH severity issues.`;
+            const comment = `# 🔒 Security Scan Results\\n\\n${safetyResults}\\n\\n${banditResults}\\n\\n${semgrepResults}\\n\\n---\\n\\n*This security scan runs automatically on source-code PRs and bi-weekly (skipped for doc/markdown-only changes).*\\n\\n📊 **Security Policy**: CI fails on vulnerabilities and HIGH severity issues.`;
             
             // Post comment with error handling
             try {