Fix build flow: lockfile bot, CPU multi-arch, paths-ignore, release guard

- update-lockfile.yml: regenerate all four lockfiles (main + cpu/rocm/intel
  variants) on any pyproject change; add variant pyproject files to trigger
- docker-publish.yml: add lockfiles to paths-ignore so the bot commit does
  not trigger a second Docker build; remove redundant CONTRIBUTING/SECURITY
  entries already covered by **.md; add QEMU to build-cpu; set CPU image to
  linux/amd64,linux/arm64 to match release
- release.yml: inline lockfile generation now covers all variants; add
  workflow_dispatch guard that fails if not dispatched from main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -37,8 +37,25 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
 
-      - name: Ensure uv.lock is current
-        run: uv lock
+      - name: Verify release branch
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          if [ "${{ github.ref_name }}" != "main" ]; then
+            echo "::error::Releases must be dispatched from main (current: ${{ github.ref_name }})"
+            exit 1
+          fi
+
+      - name: Ensure lockfiles are current
+        run: |
+          cp pyproject.toml _pyproject_orig.toml
+          for variant in cpu rocm intel; do
+            cp pyproject-${variant}.toml pyproject.toml
+            uv lock
+            cp uv.lock uv-${variant}.lock
+          done
+          cp _pyproject_orig.toml pyproject.toml
+          uv lock
+          rm _pyproject_orig.toml
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3