Risk triage and security checks for pull requests: scans only what a change adds or removes.