ci: run strict-schema via workflow_run after mirror-tarball

[bpamiri]

Summary

Fixes the long-standing red validate run that appears on main after every publish PR (#4, #5).

Root cause

Merge PRs intentionally leave tarball and sha256 as null per CONTRIBUTING.md. The mirror-tarball workflow populates them post-merge and pushes a backfill commit. The intent (stated in validate.yml comments) was for strict validation to re-run on the backfilled commit. That never happened because:

• Mirror pushes using the default GITHUB_TOKEN.
• Commits authored by GITHUB_TOKEN do not trigger downstream push/pull_request workflows (GitHub loop-prevention guardrail).
• Strict validation therefore ran only against the pre-backfill merge commit, saw null, and failed.

Fix

Switch strict-main to fire on workflow_run: mirror-tarball completed instead of racing with it on the push event.

• mirror-tarball.yml — unchanged.
• validate.yml — added workflow_run trigger; gated the four non-strict jobs with if: github.event_name != workflow_run so they dont duplicate on the follow-up run; tightened strict-main to workflow_run with conclusion == success and head_branch == main.
• strict-main now explicitly checks out ref: main — default actions/checkout behavior on workflow_run triggers is the head_sha of the triggering run, which is the pre-mirror commit. We need post-mirror state.

Before → after

Before: merge → push-to-main fires 5 checks on validate; strict-main fails (null); mirror runs, backfills, but no re-trigger → persistent red run on main.

After: merge → push-to-main fires 4 checks on validate (strict skips); mirror runs + backfills; on mirror completion a second validate run fires with only strict-main, against the post-mirror state → green.

Test plan

• Schema audit: workflow_run does not inherit the push events paths filter — all four non-strict jobs explicitly gated by github.event_name != workflow_run.
• workflow_run trigger file must land on the default branch before it activates. This PR puts it there.
• After merge, run gh workflow run mirror-tarball.yml --repo wheels-dev/wheels-packages --ref main as a no-op dispatch to verify a workflow_run-triggered validate run fires and strict-main passes.
• Next real publish (next version of any package) should show all-green on main.

Out of scope

• content-safety scans every package on every main push (expensive). Left alone — separate follow-up if we want to narrow it.
• Node.js 20 deprecation warning on actions/*@v4 — pre-existing, unrelated.