CI: one portability run per change; quic-native only for native paths

The forge has one runner slot and the portability job holds it 14-30 min. Drop the push trigger
(the PR already ran it) for a daily schedule, skip docs-only PRs, and path-filter quic-native.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/cultmesh-portability.yml

@@ -1,11 +1,17 @@
 name: CultMesh portability and performance
 
+# The forge runs one job at a time and this workflow holds the slot 14 to 30 minutes, so it runs once per change:
+# on the pull request (never again on the push that merges it), skipped for documentation-only changes, and on a
+# daily schedule so main is still exercised when nobody opens a pull request.
 on:
-  push:
-    branches:
-      - main
-      - "codex/**"
   pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
+      - "research/**"
+      - ".voidbot/**"
+  schedule:
+    - cron: "17 3 * * *"
   workflow_dispatch:
 
 concurrency:

.github/workflows/quic-native.yml

@@ -9,13 +9,21 @@ name: CultMesh QUIC native
 # from the pinned debian:13 container below, never from a local or Yggdrasil
 # build.
 
+# Only a change to the committed binaries, their manifest or this workflow can change what verify-committed checks,
+# so a branch push or pull request runs it for those paths alone; a tag always runs it.
 on:
   push:
     branches:
       - main
+    paths:
+      - "packages/cultmesh-ts/native/**"
+      - ".github/workflows/quic-native.yml"
     tags:
       - "cultmesh-quic-native-v*"
   pull_request:
+    paths:
+      - "packages/cultmesh-ts/native/**"
+      - ".github/workflows/quic-native.yml"
   workflow_dispatch:
 
 concurrency: