fix: skip security triage when scans were skipped

The security-triage job used `if: always()` which made it run even when
security-scans was skipped (due to test-and-lint failure). This caused
a "security-reports artifact not found" error. Now only runs when scans
actually succeeded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>