Stop 13 jobs firing on a README edit, and delete an SBOM check that never ran

Two GitHub-side changes, both about not wasting runs.

PATH FILTERS. tests.yml (nine jobs across three OSes and three Pythons) and
python-ci.yml (four) both triggered on every push and every pull request with
no path restriction, so editing a markdown file spent thirteen jobs. They now
trigger on the Python implementation and the files that pin its environment.
ts-parity keeps triggering on src/** as well as js/**, deliberately: Python is
the reference implementation the port is validated against, so a change there
can break parity even when no TypeScript moved.

THE SBOM STEP IS GONE. It invoked `@cyclonedx/cyclonedx-npm@latest
--package-lock-only`, which is the NPM tool and reads package-lock.json — a
file this pnpm workspace does not have and never will. It could not have
worked on any run. It then swallowed the failure with `|| echo "non-fatal"`
and uploaded with `if-no-files-found: warn`, two independent layers stopping
it from going red, and its log said "No files were found with the provided
path" every time.

Removed rather than pinned. Pinning the version of a tool that cannot read
this repository's lockfile fixes the wrong problem, and a security check that
cannot fail is the same anti-pattern as the pwsh exit-code bug fixed earlier
today — worse than absent, because it is trusted. `pnpm audit --audit-level
moderate` stays and does fail on findings. A real bill of materials wants a
pnpm-native generator, tracked in TODO.md.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.github/workflows/python-ci.yml

@@ -3,8 +3,32 @@ name: CI
 on:
   push:
     branches: [ "**" ]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 4 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/python-ci.yml"
   pull_request:
     branches: [ "**" ]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 4 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/python-ci.yml"
   schedule:
     - cron: '0 3 * * *'