Fix Security workflow audit scope

[rozling]

Why

The Security workflow audits its entire Python environment. Installing the Safety scanner also installs NLTK, whose unpatched PYSEC-2026-3740 advisory makes the job fail even though NLTK is not an application dependency.

Change

• Audit requirements.txt with pip-audit in both the required check and failure report.
• Remove the install step that was only needed for environment-wide auditing.
• Run Security on pull requests targeting main so workflow changes are checked before merge.

Validation

• actionlint .github/workflows/security.yml
• .venv/bin/python -m pytest -v --tb=short (73 passed)
• pre-commit run --all-files (all hooks passed)
• pip-audit -r requirements.txt --format json --desc (PyYAML 6.0.3, no known vulnerabilities)