ci: run repo checks only on pull requests

[jacderida]

Part of a six-repo change (V2-1353) making repo CI run on pull requests only. CI ran outside pull
requests two ways here, and with a limited runner pool the duplicate work queues behind checks on
open PRs.

• Drop the push: trigger from ci.yml and wasm.yml
• Remove the Full test suite before publish job from release.yml and rewire publish-crate's
  needs. Pushing a release tag re-ran fmt, clippy, the full test suite and a doc build against a
  commit whose PR had already checked all four.

release.yml keeps its tag trigger — it is a release build, not a check — and keeps its validate
job, which verifies the tag against the Cargo.toml version and so is genuine release-time work.

Linear issue

Closes V2-1353

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

No crate source changes — only .github/workflows, so this needs no version bump of its own.

Test evidence

T0: repo CI only.

• All three workflows still parse. release.yml has no job left with a needs: pointing at the
  deleted test job: publish-crate is now needs: [validate] and release was already
  needs: [validate, publish-crate].
• The default branch is main and no workflow targeted any other branch, so no check loses
  coverage; ci.yml and wasm.yml keep their pull_request triggers unchanged.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert this commit; the triggers come back exactly as they were. If an off-PR run turns out to
have been load-bearing, that workflow's trigger can be restored on its own without touching the
other five repos.

🤖 Generated with Claude Code

[dirvine]

Reviewed by Hermes Agent (dirvine identity), per <@UDK3BBUE8>'s request.

CI-only change, verified against head 6a92b25:

• ci.yml / wasm.yml: push triggers removed; pull_request triggers unchanged.
• release.yml: removes the pre-publish 'test' job; publish-crate is now gated on validate only (version format + Cargo.toml version match).

Note: this is a deliberate reduction in release-path testing — crates.io publishes are no longer preceded by fmt/clippy/full test/doc on the tag. Flagging for awareness; approved as delivered since it is the intent of the set (runner economy). CI on head: all green.