ci: path-gate jobs, cache builds, cancel superseded runs

[Connorrmcd6]

Why

CI ran clippy + a 2-OS test matrix + a RustSec audit on every PR — no path filtering, no build cache, no concurrency cancellation. A markdown-only PR paid for the full Rust pipeline, the audit ran even when no dependency changed, and every run cold-compiled.

What changed

ci.yml

• Path-gate the pull_request trigger so docs/npm/scripts-only PRs run zero Rust jobs. The dogfood step (surf lint/check) reads hubs/**, AGENTS.md, and surf.toml, so those are included in the trigger — a hub edit still runs tests. Pushes to main stay unfiltered (pre-release safety).
• Swatinem/rust-cache added to check and test (SHA-pinned, v2.9.1) — builds were cold every run.
• concurrency so a new commit cancels its superseded PR run; main runs are never cancelled mid-flight (cancel-in-progress is gated to pull_request).

audit.yml (new) — RustSec scan moved out of ci.yml, gated on Cargo.lock/Cargo.toml changes plus a weekly cron. Advisories are disclosed independently of our commits, so the cron still catches a CVE on an unchanged, pinned dependency. On schedule, rustsec/audit-check opens an issue rather than failing a PR — the desired outcome for drift.

Reuses the existing pinned checkout / audit-check SHAs; dependabot's github-actions ecosystem already tracks these for bumps.

Net effect

PR touches	check	test	audit
*.rs / Cargo.*	✅	✅	✅
hubs/**, AGENTS.md, surf.toml	✅	✅	⛔
docs/**, npm/**, scripts/** only	⛔	⛔	⛔
weekly cron	—	—	✅

Heads-up / behaviour change

A docs-only PR now shows no Rust CI checks at all — not failures, simply none triggered. Safe here since main has no branch protection, but worth knowing: for a docs-only PR there's nothing to "wait for green" on, and that's expected.

Verification

• Workflow YAML parses cleanly.
• This PR touches .github/workflows/ci.yml (in the paths include) but no Cargo.*, so it's the live test: CI should run (check + test); Audit should not.
• Post-merge spot-checks: a docs-only PR triggers nothing; a dependabot Cargo bump triggers Audit; a second push to a PR cancels the prior run; second check/test run reports a rust-cache hit.

🤖 Generated with Claude Code