Only run CI on pull requests to main, not on direct pushes.
Move test running to a dedicated push.yml workflow that triggers on both push and PR, and restrict deploy.yml to push-to-main only.