chore: streamline CI triggers, docs-only skip, venv cache, version-gated publish

[sjwan01]

Summary

Streamlines the CI and publish workflows to eliminate noise and waste:

ci.yml

• push narrowed to branches: [main] — feature-branch pushes are covered by pull_request, so the same commit no longer runs CI twice; tags no longer trigger CI.
• paths-ignore for docs-only changes (**/*.md, LICENSE) — documentation PRs skip the full matrix entirely. .github/ is deliberately NOT ignored (CI changes must be verified by CI).
• actions/cache for the venv (key: python version + pyproject.toml hash, with restore-keys) — make bootstrap goes from minutes to seconds on cache hit.

publish.yml

• A "Check version changed" step gates the whole flow: a merge to main without a version bump (e.g. docs) skips bootstrap/check/build/twine/upload. Version-changing merges and manual workflow_dispatch runs run the full flow. skip-existing remains as a second guard on TestPyPI.

Behavior after merge

• PR: CI runs (re-runs on each push to the branch).
• Merge to main: CI runs (merged state).
• Version-changing merge: publish runs full flow → TestPyPI.
• Docs-only merge: no CI, publish triggers but skips everything except the version check.
• Tag push: no CI, no publish.