9fc47b3d41
- ci.yml: only run on Go/frontend source and lockfiles. - codeql.yml: scope push/PR triggers to Go and JS/TS sources; weekly cron still does a full scan. - release.yml: add matching paths allowlist to pull_request so doc/workflow-only PRs don't kick off the multi-arch build. Skips workflow runs on changes to docs, translations, GitHub configs, and unrelated scripts.