Saves Actions minutes — code pushed directly to main doesn't need
a redundant CI run. PRs are the gate. Publish workflow is the final
check for releases.