Standardise PR workflow on ci.yml and drop scheduled SBOM scan

DEVELOPMENT.md

@@ -63,7 +63,7 @@ poetry.lock                locked dependency graph
 README.md                  user-facing documentation
 .filedust.conf.example     example user include/exclude configuration
 .pre-commit-config.yaml    Bandit, Black, and generic pre-commit hooks
-.gitea/workflows/          lint, dependency audit, SBOM, and Grype workflows
+.gitea/workflows/          lint and dependency-audit workflows
 dist/                      built release artifacts, not source
 ```
 
@@ -428,17 +428,6 @@ Gitea pull request workflow:
   -> pip-audit dependency audit
 ```
 
-Scheduled/manual security workflow:
-
-```text
-.gitea/workflows/security-scan.yml
-  -> install verified Cosign, Syft, and Grype
-  -> generate SBOM
-  -> scan for vulnerabilities
-  -> notify Node-RED on fixable vulnerabilities
-  -> fail workflow on fixable Medium, High, or Critical vulnerabilities
-```
-
 Pre-commit currently includes Bandit, Black, trailing whitespace, EOF, YAML, and TOML checks.
 
 Bandit is configured for `src/filedust/` and skips `B110` and `B112`, which reflects the codebase's deliberate best-effort exception handling in filesystem traversal.