Scope the push trigger to the main branch only. Previously `on: [push,
pull_request]` fired two runs for every commit pushed to a feature
branch with an open PR — one for the push event and one for the
pull_request event. With this change, feature-branch commits trigger
only via pull_request; direct pushes to main (merge commits) trigger
via push.
Closes#483
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
