ecce5df30f
`on: push` unrestricted plus `on: pull_request` means a branch with an open PR fires BOTH triggers, so every job ran twice — visible as the (push) and (pull_request) pairs in the checks list, twelve successful checks where six would do. Across this campaign's twelve PRs that is a lot of wasted runner time, and the browser harness job alone is four minutes each. Restricting push to main keeps exactly one run per commit: a PR branch is covered once by pull_request, main once by push. pages-deploy is unaffected — it already gates on `github.event_name == 'push' && github.ref == 'refs/heads/main'`. Checked the other workflows: claude.yml is event-driven and release.yml already scopes push to tags, so ci.yml was the only one doubling. Deliberately does not touch claude-code-review.yml, which PR #35 is changing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>