ci: stop running CI twice on internal PRs (dfinity#3804)

Since dfinity#3782 added a
`pull_request` trigger, every commit on an internal PR branch fires
**both** `push` and `pull_request`, running every CI job twice. This PR
scopes the `push` trigger so PR branches fire only `pull_request`,
eliminating the duplicate runs.

## Changes

- [canister-tests.yml](.github/workflows/canister-tests.yml): `push` →
`branches: [main]` + `tags: ['release-*']`
- [frontend-checks.yml](.github/workflows/frontend-checks.yml): `push` →
`branches: [main]`
- [rust.yml](.github/workflows/rust.yml): `push` → `branches: [main]`

## When each trigger fires after this change

| Scenario | `push` | `pull_request` |
|---|---|---|
| Push to internal PR branch | — | ✓ |
| Push to fork PR branch | — | ✓ |
| Merge to `main` | ✓ | — |
| Push release tag (`release-*`) | ✓ (canister-tests only) | — |

Release flow, main-branch post-merge CI, and fork PR CI are preserved.

## Caveat — auto-commit formatting

The `cargo-fmt` auto-commit in `rust.yml` and the `Commit type
interfaces` step in `frontend-checks.yml` were previously gated on
`push` to non-`main` branches. Since `push` no longer fires on feature
branches, these steps are now inert. The conditions have been tightened
so they cannot spuriously fire on tag pushes. Re-enabling them for
same-repo PRs is possible but requires adjusting the `checkout` ref and
token handling, which is out of scope here — please run `cargo fmt` /
`npm run generate` locally until that follow-up lands.

Author: sea-snake

.github/workflows/canister-tests.yml

@@ -5,7 +5,10 @@ name: Canister tests
 
 on:
   push:
+    branches: [main]
+    tags: ['release-*']
   pull_request:
+  merge_group:
 
 jobs:
   #####################

.github/workflows/frontend-checks.yml

@@ -2,7 +2,9 @@ name: Frontend checks and lints
 
 on:
   push:
+    branches: [main]
   pull_request:
+  merge_group:
 
 jobs:
   frontend-checks:
@@ -38,9 +40,9 @@ jobs:
           done < <(jq <src/frontend/src/flows/dappsExplorer/dapps.json -cMr '.[] | .logo' )
       - name: Commit type interfaces
         uses: EndBug/add-and-commit@v9
-        # We don't want to commit automatic changes to main, and we can't
-        # push to fork PRs (read-only token).
-        if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
+        # Push only fires on `main` now, so this is inert. Preserved for
+        # reference; re-enable by gating on a suitable event.
+        if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && github.ref != 'refs/heads/main' }}
         with:
           add: |
             src/frontend/generated

.github/workflows/rust.yml

@@ -3,7 +3,9 @@ name: Rust
 
 on:
   push:
+    branches: [main]
   pull_request:
+  merge_group:
 
 jobs:
   cargo-fmt:
@@ -29,9 +31,9 @@ jobs:
 
       - name: Commit Formatting changes
         uses: EndBug/add-and-commit@v9
-        # We don't want to commit formatting changes to main, and we can't
-        # push to fork PRs (read-only token).
-        if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
+        # Push only fires on `main` and release tags now, so this is inert.
+        # Preserved for reference; re-enable by gating on a suitable event.
+        if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && github.ref != 'refs/heads/main' }}
         with:
           add: "**/*.rs"
           default_author: github_actions