ci: skip bench/fuzz/ci on docs/safety-only changes

[avrabe]

Summary

Reduces meld's draw on the shared smithy rust-cpu fleet by adding conservative paths-ignore filters to bench.yml, fuzz.yml, and ci.yml. PRs that only edit Markdown, safety/, scripts/mythos/, or tools/*.py skip the rust-cpu jobs (~9 jobs saved per docs-only PR). Substantive code PRs unaffected.

This was prompted by today's repeated fleet capacity crunches — but the framing isn't "save the fleet from us." Smithy's 7 rust-cpu runners are MORE resources than GitHub-hosted would give us; the right response is to be a leaner consumer, not to push other repos off.

Workflows NOT touched

Workflow	Why filtering would defeat its purpose
mythos-gate.yml	Fires on Tier-5 .rs changes (already implicitly filtered)
mythos-auto.yml	Same
verification-gate.yml	Fires on safety/stpa/loss-scenarios.yaml — silencing that workflow on safety changes is exactly what we don't want
release.yml	Tag-triggered, not PR-triggered
fixtures.yml	Manual workflow_dispatch only

Tradeoff

Docs-only PRs get no compile-check. This is fine because they have nothing to compile. The risk is a Markdown-only PR somehow breaking the code — basically impossible for the path types we're excluding.

Sequencing

This PR itself touches only .github/workflows/** + CHANGELOG, so:

• bench/fuzz/ci WILL still trigger on this PR (workflows themselves aren't in paths-ignore)
• Once merged, the NEXT PR that's docs-only will see the savings
• The LS-N gate, mythos-gate, mythos-auto continue firing as before

Test plan

• All CI workflows fire normally on this PR (path filters don't apply to themselves)
• After merge, open a docs-only test PR to verify the skip behavior
• No required-check breakage on merge (path-filtered workflows simply don't run; they don't fail)

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 19/19 approved LS entries verified

	count
Passed (≥1 test, all green)	19
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}