ci: stop running every branch push twice

on: [push, pull_request] produced two runs per push on any branch with an open PR --
same commit, same workflow, same tests. Restricting push to main leaves branch work
covered by the pull_request run and main covered by the push run, with nothing running
twice and no loss of coverage.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -1,6 +1,12 @@
 name: CI
 
-on: [push, pull_request]
+on:
+  # Only main on push. Branch pushes are already covered by the pull_request run;
+  # `on: [push, pull_request]` ran both, burning two runners on identical work and
+  # doubling the exposure to runner flakes.
+  push:
+    branches: [main]
+  pull_request
 
 jobs:
   build: