ci: add risk-based verification fast path

[regenrek]

Why

• Reduce documentation and small-change verification from broad repeated suites to deterministic risk-based profiles.
• Keep security tooling available locally while removing automatic PR/push security, secret, vulnerability, cargo-audit, BetterLeaks, Trivy, and dependency scans.

How

• Classify exact changed paths and run only the selected verification profile.
• Build docs once, bind the output to the source SHA, and promote that artifact without rebuilding.
• Keep focused browser verification only for explicitly interactive documentation changes.

Tests

• 14 verification-policy fixtures passed.
• Docs receipt: 5 commands, exactly 1 build, 0 security commands.
• Docs promotion: 0 rebuilds, 1 deploy, 5 bounded route checks.
• 27 adversarial workflow contract cases passed.
• Pi (19 surfaces), Grok (13 surfaces), maintenance, risk-guidance and local zizmor checks passed.