ci: drop push:main trigger from ci and fuzz workflows (#47)

PR CI already validates the merged-state tree (GitHub tests
pull/N/merge). Re-running ci.yml and fuzz.yml on main after a
squash-merge adds no signal and costs ~2 min per merge.

CodeQL keeps its push:main trigger — the Security tab default-branch
data requires a push-scoped SARIF upload.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/ci.yml

@@ -1,8 +1,6 @@
 name: ci
 
 on:
-  push:
-    branches: [main]
   pull_request:
 
 permissions: read-all

.github/workflows/fuzz.yml

@@ -4,8 +4,6 @@ name: fuzz (smoke)
 # for continuous fuzzing (OSS-Fuzz Tier 2) — just catches obvious
 # regressions before merge.
 on:
-  push:
-    branches: [main]
   pull_request:
 
 permissions: read-all