ci: don't run on main branch push — PR trigger covers pre-merge safety

Release is now cut by creating a Forgejo release on main with a v* tag;
the tag push event triggers CI + Docker build/push.

.forgejo/workflows/ci.yml

@@ -1,9 +1,12 @@
 # CI runs first; build only proceeds if all checks pass.
 #
-# Push to dev:  typecheck + lint + test → build :dev + :<sha>
+# Push to dev:       typecheck + lint + test → build :dev + :<sha>
-# Push to main: typecheck + lint + test only (no build — wait for release tag)
+# Tag v* (release):  typecheck + lint + test → build :latest + :<sha> + :<version>
-# Tag v*:       typecheck + lint + test → build :latest + :<sha> + :<version>
+# Pull request:      typecheck + lint + test only (no build)
-# Pull request: typecheck + lint + test only (no build)
+#
+# To cut a release:
+#   Create a release via the Forgejo UI on main with a v* tag name.
+#   The tag push triggers this workflow; build job pushes :latest + :<version>.
 #
 # Required secrets (repo → Settings → Secrets → Actions):
 #   REGISTRY_USER   — your Forgejo username
@@ -12,7 +15,7 @@ name: CI & Build
 
 on:
   push:
-    branches: [main, dev]
+    branches: [dev]
     tags: ["v*"]
     paths:
       - "src/**"