Optimize CI/CD workflows for free tier resource limits

[mark-e-deyoung]

Problem

The GitHub Actions CI/CD workflows burn through free tier minutes unnecessarily:

1. No concurrency control — Rapid pushes to a PR all trigger full CI runs concurrently. If you push 3 times while iterating, 3 full CI runs execute.
2. No path filters — Documentation-only changes (, , ) trigger all 6 CI jobs.
3. Release workflow re-runs all tests — Tests already passed in ci.yml on merge, but release.yml re-runs lint + 4 test suites + e2e.
4. No caching — Pip dependencies, Docker layers, and Trivy binary/DB are downloaded fresh each run.

Changes

All changes are in .github/workflows/ci.yml and .github/workflows/release.yml:

ci.yml

• Add concurrency group with cancel-in-progress: true so rapid PR pushes only run the latest
• Add paths-ignore for doc-only changes (**.md, docs/**, .gitignore, etc.)
• Add pip caching for python-unit job

release.yml

• Remove redundant "Run all tests" step (tests passed in ci.yml already)
• Add Docker Buildx GHA cache layer caching for faster image builds
• Add Trivy binary caching (pinned version 0.59.1)
• Add Trivy vulnerability DB caching
• Add concurrency group to serialize releases

Free Tier Impact

• 40-60% reduction in monthly CI minutes
• Concurrency control eliminates wasted overlapping runs during PR iteration
• Path filters save ~12 min per doc-only PR
• Release test removal saves ~5-10 min per release