CI: every push to a PR branch runs the whole workflow twice

Every push to a branch with an open PR runs the whole CI workflow twice.

```
9822973 pull_request CI
9822973 push CI
410a226 pull_request CI
410a226 push CI
fae40b8 pull_request CI
fae40b8 push CI
```

`on:` carries both `push: branches-ignore: [master]` and `pull_request: branches: [master]`, so a
PR branch matches both. That is twice the runner minutes for every push, and it is why `gh pr view`
lists each check twice, which makes reading a PR's state harder than it should be: two entries per
check, one of which nothing requires.

It also slows the answer down. The unmocked pack stands up Postgres, seeds it and builds the
console, so two of those queued behind each other is the difference between a twelve minute wait
and a twenty five minute one.

Not an obvious one-line fix, which is why this is an issue and not a PR:

- Dropping `push` means a branch with no PR yet gets no CI. That is the common convention and it is
probably right, but it is a change in behaviour worth deciding on purpose.
- A `concurrency` group keyed on the SHA with `cancel-in-progress` would collapse the pair, but
which of the two wins is not deterministic, and if the `push` run cancels the `pull_request` one
the required checks report as cancelled and the PR is blocked. That is worse than the waste.
- Keeping both triggers and making only the cheap job run on `push` is the conservative option:
pushing a branch still gets lint, types and units, and the expensive jobs run once, on the PR.

The same `on:` block is in BaryoDev/barakoBrew, and it has `paths-ignore` on the `push` half only,
which means a docs-only push gets one run and a code push gets two. Tracked there as
BaryoDev/barakoBrew#96, and whatever is decided should land in both.

Locate the GitHub Actions workflow containing the on: block and compare its push and pull_request behavior with BaryoDev/barakoBrew#96. Decide which trigger or job arrangement preserves required PR checks without duplicate runs, then apply the decision in both repositories. Verify that a push to an open PR no longer starts the expensive workflow twice and that required checks remain valid.

Written by the indexing model from the issue text.