docs: describe what the scan does on manual dispatch

[altaywtf]

Summary

docs/DISTRIBUTION.md said a manual dispatch has Actionlint and Zizmor audit "the full history". They lint every workflow in the current tree; full history is what Gitleaks scans, and the shared scan leaves Gitleaks off for public repositories. The trigger list also gains the manual dispatch ci.yml already accepts.

-1. `verify` on pull requests and `main` pushes.
+1. `verify` on pull requests, `main` pushes, and manual dispatch.
-…and an Actionlint and Zizmor audit when a `main` push changes workflows, or of the full history on manual dispatch.
+…and an Actionlint and Zizmor audit when a `main` push changes workflows and on manual dispatch. GitHub secret scanning and push protection cover secrets in this public repository.

Risks

None; docs: publishes nothing.

Verification

The secret-scanning sentence matches the repository's live settings (secret scanning and push protection both on).

Follow-Ups

N/A

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.