ci: trigger CI on workflow-file changes too

The push/pull_request paths filter didn't include .github/workflows/**,
so the previous commit (fixing the Audit step) never actually ran
through CI -- editing the workflow itself silently skipped the trigger.
A broken workflow-syntax change could merge untested the same way.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
       - "go.sum"
       - "frontend/**"
       - ".nvmrc"
+      - ".github/workflows/**"
   push:
     branches:
       - main
@@ -17,6 +18,7 @@ on:
       - "go.sum"
       - "frontend/**"
       - ".nvmrc"
+      - ".github/workflows/**"
 
 permissions:
   contents: read