fix(workflows): scope reviewer auto-triggers by changed-file subsets

[Copilot]

Summary

/review fan-out was over-triggering on automated docs/tests PRs. This change narrows PR-event auto-triggers so docs-only and test-only changes invoke only the relevant reviewer subset, while keeping on-demand /review fan-out unchanged.

• Security reviewer trigger scoping
  • Added pull_request.paths to review-security so it only auto-runs for security-relevant code/workflow surfaces (src/**, ado-aw-derive/**, scripts/ado-script/src/**, selected package manifests, workflow files, Cargo.toml).
• Compiler-contract reviewer trigger scoping
  • Tightened review-compiler-contract pull_request.paths to compiler/runtime/workflow-source changes; removed docs/test-only paths from auto-trigger scope.
• Docs alignment
  • Updated AGENTS.md reviewer table language to reflect scoped auto-trigger behavior rather than unconditional ready_for_review fan-out.
• Generated workflow sync
  • Regenerated lock files for both modified reviewers to keep source and compiled workflow definitions aligned.

on:
  pull_request:
    types: [ready_for_review]
    paths:
      - "src/**"
      - "ado-aw-derive/**"
      - "scripts/ado-script/src/**"
      - ".github/workflows/**"

Test plan

• gh aw compile --validate review-compiler-contract review-security

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.