ci: run the full suite only on main and releases

[harlan-zw]

Why

PR checks were slow. Every PR ran the full matrix even for small changes.

What

• PRs run lint, typecheck, build, and JS tests only
• cargo test, protocol v1 drift check, publint, attw, pack, and the native matrix run on push to main only
• Feature branch pushes no longer trigger CI, so each PR runs once
• Releases run pnpm build and the full pnpm test:run before publishing

Tradeoff

Rust breakage on Windows or macOS now surfaces on main or at release time, in the PR.