ci: run the suite once per PR, not twice per merge

[eaitbrahim]

What

ci.yml triggered on both pull_request and push: branches: [main], so every squash-merge re-ran the full suite (lint, test, build identity) on content that had already passed minutes earlier as the PR run. That's roughly double the Actions minutes for zero new information, since the merge commit's tree is identical to what the PR run already tested.

• Removed the push: branches: [main] trigger.
• Added workflow_dispatch so the suite can still be run on demand against main (e.g. before cutting a release, or after changing branch protection settings).
• Kept pull_request — that's the gate that actually protects merges, and for a tool that moves money it's the one worth paying for.
• Rewrote the header comment: the old one justified running on push ("otherwise main can drift red between releases and the gate discovers it at the worst moment"), which is exactly the reasoning being traded away here, so it no longer belonged.

Why this is safe

release.yml already re-runs ruff + pytest as its own gate before it will build an artifact — "a red suite must never produce an artifact that could touch funds." So main still cannot ship red even with nothing running automatically on push.

Residual risk (stated plainly)

A PR that was green against an older main can merge and turn out to be semantically red against the main it actually landed on — two independently-green changes that conflict once combined. Previously, the push-triggered CI run would have caught that immediately on merge. Now it surfaces at release time instead.

Branch protection's "require branches to be up to date before merging" would close this gap by forcing every PR to re-test against the latest main before merge — but that's deliberately not being relied on here, since it would reintroduce the double-run cost this PR removes (just moved to before-merge instead of after).

Validation

• uv run python -c "import yaml; print(list(yaml.safe_load(open('.github/workflows/ci.yml')).keys()))" parses cleanly (PyYAML maps the bareword on key to True per YAML 1.1 — a pre-existing quirk unrelated to this change, confirmed identical on the pre-change file and on release.yml).
• Confirmed no docs reference CI running on push/merge (docs/RELEASING.md checked); no doc changes needed.
• Only .github/workflows/ci.yml touched — triggers and header comment only, job steps unchanged.

Closes #200