ci: build every branch again, still without duplicate runs

[s-celles]

#9 removed the push: ['**'] wildcard to stop the matrix running twice on the same commit. It worked — #8 went from six checks to three — but it also removed CI from branches with no open PR. I flagged that trade-off in #9 without knowing whether it mattered to you. It does. This gets both.

How

The wildcard is back on push. The duplication is now prevented at the job rather than at the trigger:

if: >-
  github.event_name != 'pull_request'
  || github.event.pull_request.head.repo.full_name != github.repository

When both events fire for a branch in this repository, the push run covers the commit and the pull_request run is skipped.

Fork PRs are exempted from the skip. A fork's branch produces no push event here, so without that exemption a fork PR would get no CI at all — worse than the doubling this fixes.

Situation	Before #9	After #9	This PR
Branch, no PR	✅ built	❌ nothing	✅ built
Branch, same-repo PR	⚠️ built twice	✅ once	✅ once
Fork PR	✅ built	✅ built	✅ built
main, tags	✅ built	✅ built	✅ built

The trade-off, stated

A same-repository PR is now tested at its branch head, not at the merge with main. That is what push gives you; pull_request builds refs/pull/N/merge instead.

Fork PRs keep merge-result testing. For a repository whose branches are mostly its maintainer's, branch-head testing is the ordinary arrangement — but if main moves under a long-lived PR, update the branch to get a true signal. Worth knowing rather than discovering.

If you would rather keep merge-result testing for your own PRs and accept the doubling, say so and I will revert to the original triggers — that is a legitimate choice, and the cost is only CI minutes.

Concurrency

Now cancels superseded runs on any ref that is not main and not a tag. Feature branches are built through push again, so repeated pushes should supersede rather than race. main and tags still record every commit.

Testing

Workflow-only. YAML validated locally: the wildcard, the tag trigger, the job if and the concurrency expression all parse and resolve as intended.

This PR is its own partial test: it is a same-repository PR, so it should report three checks from the push event, with the pull_request run skipped. What it cannot test from here is the fork path — that only shows the first time someone opens a PR from a fork.