ci: let CI, web CI and the secret scan be triggered on demand

.github/workflows/ci.yml

@@ -18,6 +18,10 @@ on:
       - 'LICENSE'
       - '.gitignore'
 
+  # On demand. The triggers above both wait on an event, so a green build can only be confirmed
+  # by producing one. No paths-ignore here: asking by hand means asking for the whole thing.
+  workflow_dispatch:
+
 permissions:
   contents: read
 

.github/workflows/secret-scan.yml

@@ -7,6 +7,10 @@ on:
   pull_request:
     branches: [main]
 
+  # On demand, so history can be rescanned after a rule change in .gitleaks.toml without
+  # waiting for the next push to main.
+  workflow_dispatch:
+
 permissions:
   contents: read
 

.github/workflows/web-ci.yml

@@ -8,6 +8,11 @@ on:
     branches: [main]
     paths: ['web/**', '.github/workflows/web-ci.yml']
 
+  # On demand, and this one needs it most: the paths filter means a change outside web/ never
+  # runs it, so it can sit unexercised for long stretches with nothing reporting that. No paths
+  # filter on the manual trigger — the point of pressing it is to run regardless.
+  workflow_dispatch:
+
 permissions:
   contents: read