ci(cache): stop PR CI, bundle, and benchmark cache writes

.github/workflows/bench.yml

@@ -8,6 +8,8 @@ on:
       - "go.sum"
       - ".github/workflows/bench.yml"
 
+cache-mode: read
+
 concurrency:
   group: benchmark-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/ci-pr.yml

@@ -0,0 +1,12 @@
+name: CI
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    cache-mode: read
+    uses: ./.github/workflows/ci.yml

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 on:
   push:
     branches: [main]
-  pull_request:
+  workflow_call:
   workflow_dispatch:
 
 permissions:

.github/workflows/kennembed-pr.yml

@@ -0,0 +1,24 @@
+name: kennembed release bundles
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/kennembed-pr.yml'
+      - '.github/workflows/kennembed.yml'
+      - '.github/workflows/ci.yml'
+      - '.github/scripts/stage-onnx.py'
+      - 'cmd/kennembed/**'
+      - 'embedserver/**'
+      - 'embedlocal/**'
+      - 'embedclient/**'
+      - 'internal/embedassets/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Makefile'
+permissions:
+  contents: read
+jobs:
+  bundle:
+    permissions:
+      contents: write
+    cache-mode: read
+    uses: ./.github/workflows/kennembed.yml

.github/workflows/kennembed.yml

@@ -1,18 +1,6 @@
 name: kennembed release bundles
 on:
-  pull_request:
-    paths:
-      - '.github/workflows/kennembed.yml'
-      - '.github/workflows/ci.yml'
-      - '.github/scripts/stage-onnx.py'
-      - 'cmd/kennembed/**'
-      - 'embedserver/**'
-      - 'embedlocal/**'
-      - 'embedclient/**'
-      - 'internal/embedassets/**'
-      - 'go.mod'
-      - 'go.sum'
-      - 'Makefile'
+  workflow_call:
   workflow_dispatch:
     inputs:
       tag: