Fix build flow: lockfile bot, CPU multi-arch, paths-ignore, release guard

- update-lockfile.yml: regenerate all four lockfiles (main + cpu/rocm/intel
  variants) on any pyproject change; add variant pyproject files to trigger
- docker-publish.yml: add lockfiles to paths-ignore so the bot commit does
  not trigger a second Docker build; remove redundant CONTRIBUTING/SECURITY
  entries already covered by **.md; add QEMU to build-cpu; set CPU image to
  linux/amd64,linux/arm64 to match release
- release.yml: inline lockfile generation now covers all variants; add
  workflow_dispatch guard that fails if not dispatched from main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/update-lockfile.yml

@@ -5,6 +5,9 @@ on:
   push:
     paths:
       - 'pyproject.toml'
+      - 'pyproject-cpu.toml'
+      - 'pyproject-rocm.toml'
+      - 'pyproject-intel.toml'
   workflow_dispatch:
 
 jobs:
@@ -30,24 +33,32 @@ jobs:
       - name: Set up Python
         run: uv python install 3.13
 
-      - name: Regenerate lockfile
-        run: uv lock
+      - name: Regenerate all lockfiles
+        run: |
+          cp pyproject.toml _pyproject_orig.toml
+          for variant in cpu rocm intel; do
+            cp pyproject-${variant}.toml pyproject.toml
+            uv lock
+            cp uv.lock uv-${variant}.lock
+          done
+          cp _pyproject_orig.toml pyproject.toml
+          uv lock
+          rm _pyproject_orig.toml
 
       - name: Check for changes
         id: diff
         run: |
-          if git diff --quiet uv.lock; then
+          if git diff --quiet uv.lock uv-cpu.lock uv-rocm.lock uv-intel.lock; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Commit and push updated lockfile
+      - name: Commit and push updated lockfiles
         if: steps.diff.outputs.changed == 'true'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add uv.lock
-          git commit -m "chore: update uv.lock"
+          git add uv.lock uv-cpu.lock uv-rocm.lock uv-intel.lock
+          git commit -m "chore: update lockfiles"
           git push
-