ci: stop running every job twice on PR branches

`on: push` unrestricted plus `on: pull_request` means a branch with an open PR
fires BOTH triggers, so every job ran twice — visible as the (push) and
(pull_request) pairs in the checks list, twelve successful checks where six
would do. Across this campaign's twelve PRs that is a lot of wasted runner time,
and the browser harness job alone is four minutes each.

Restricting push to main keeps exactly one run per commit: a PR branch is
covered once by pull_request, main once by push. pages-deploy is unaffected —
it already gates on `github.event_name == 'push' && github.ref == 'refs/heads/main'`.

Checked the other workflows: claude.yml is event-driven and release.yml already
scopes push to tags, so ci.yml was the only one doubling.

Deliberately does not touch claude-code-review.yml, which PR #35 is changing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,7 +1,12 @@
 name: CI
 
 on:
+  # `push` unrestricted plus `pull_request` ran every job TWICE on any branch
+  # with an open PR — visible as the (push) / (pull_request) pairs in the checks
+  # list. Restricting push to main means a PR branch is covered once by
+  # pull_request, and main once by push, which is also what pages-deploy needs.
   push:
+    branches: [main]
   pull_request:
 
 env: