ci: run push-triggered CI on branches only, not tags — reference/release tags point at historical trees that fail current gates by design (scheduled-emitter-ref at 8b08769 red-X'd on push); PRs and manual dispatch unchanged - #10