ci: replace PR notify workflow with main-only failure notification

Remove notify-ci-failure.yml (workflow_run on all builds, showing
skipped in Actions tab for every PR). Replace with notify-main-failure.yml
which uses branches: [main] filter so it only fires on push-to-main
CI failures — never triggered by PR branch builds at all.

Author: gmarzot

.github/workflows/notify-ci-failure.yml

@@ -0,0 +1,49 @@
+name: notify main failure
+
+# Fires only when the build workflow completes on main (push events).
+# PR branch builds never match the branches: [main] filter.
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  notify:
+    if: github.event.workflow_run.conclusion == 'failure'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Notify Slack
+        continue-on-error: true
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
+        run: |
+          SHORT="${{ github.event.workflow_run.head_sha }}"
+          SHORT="${SHORT:0:12}"
+          RUN_URL="${{ github.event.workflow_run.html_url }}"
+          TEXT=":x: *${{ github.repository }}* \`main\` CI failed — <${RUN_URL}|run>"
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            --data "{\"text\": \"${TEXT}\"}"
+
+      - name: Notify email
+        continue-on-error: true
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.OMOQ_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.OMOQ_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: |
+          SHORT="${{ github.event.workflow_run.head_sha }}"
+          SHORT="${SHORT:0:12}"
+          RUN_URL="${{ github.event.workflow_run.html_url }}"
+          aws ses send-email \
+            --from "noreply@ci.openmoq.org" \
+            --destination '{"ToAddresses":["github-notifications@openmoq.org"]}' \
+            --message "{
+              \"Subject\": {\"Data\": \"[o-rly] CI failed on main ${SHORT}\"},
+              \"Body\": {\"Text\": {\"Data\": \"${{ github.repository }} · main · ${SHORT}\n${RUN_URL}\"}}
+            }"