ci: stop running unit/integration/e2e twice per PR push

[josephschorr]

Problem

The CI workflow triggers on both events with no filters:

on:
  push:
  pull_request:

Pushing a commit to a branch with an open PR fires two events for that same commit — push and pull_request (synchronize) — so every job (unit, integration, e2e, frontend) runs twice, once shown as (push) and once as (pull_request) in the Checks UI. Same tests, same commit, double the CI minutes (e2e alone is 90 min).

Fix

on:
  push:
    branches: [main]
  pull_request:

• PR branches → only pull_request runs (once per push). Duplicate gone.
• main (after merge) → only push runs, so main stays validated.

Plus a concurrency group that cancels superseded PR runs on re-push, but never cancels main runs (so every merge commit is fully validated):

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Verification

• actionlint passes clean on the updated workflow.
• YAML parses; trigger/concurrency/job structure confirmed.