chore(ci): De-Duplicate CI Jobs

[refcell]

Summary

• Restrict push trigger to main branch only in CI workflows
• Add concurrency control to cancel in-progress runs on new pushes

Why

Previously, PRs triggered both pull_request and push events, causing duplicate CI runs. Now PRs only trigger pull_request, and push only runs on merges to main. The concurrency group also cancels stale runs when new commits are pushed, saving CI resources.

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2