ci: run push workflows only on develop, main and release tags

Every commit on a branch with an open PR ran the whole pipeline twice, once
for the push and once for the pull_request event, in separate concurrency
groups. Filter the push trigger to develop, main and v* tags so other
branches run CI and publish their images only through their PR. Tags are
listed explicitly because a branch filter alone stops tag pushes.

Update the trigger, benchmark and image prose in the README and the Gitea
Actions guide to match.

Refs #309

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
     push:
+        branches: [develop, main]
+        tags: ['v*']
     pull_request:
         types: [opened, reopened, synchronize, edited]
     workflow_dispatch:

README.md

@@ -249,13 +249,13 @@ The server answers `GET` and `HEAD` only (other methods get 405). It serves file
 
 [`.gitea/workflows/ci.yml`](.gitea/workflows/ci.yml) defines Gitea Actions validation, functional coverage, production builds, security scans, and Docker image publication. [Issue #268](https://gitea.nessar.fr/nessar/vac-optimizer/issues/268) tracks activation. Actions is enabled with owner approval; publisher credentials and live workflow validation are still pending. The [activation guide](docs/gitea-actions.md) records runner, credential, permission, and merge-gate requirements.
 
-The workflow runs on branch/tag pushes, PR opening/reopening/synchronization/edits, and manual dispatch. Manual runs validate without publishing images. Required jobs cover policy regression tests, GitFlow and Conventional Commits, ESLint, Prettier, `bun check` type checks, Bun coverage, the production build, Semgrep SAST, and Trivy dependency/secret scans. Coverage, build output, and SARIF reports are retained for seven days.
+The workflow runs on pushes to `develop` and `main`, `v*` tag pushes, PR opening/reopening/synchronization/edits, and manual dispatch. Other branches run CI only through their PR, so a branch without a PR gets no automatic CI or image. Manual runs validate without publishing images. Required jobs cover policy regression tests, GitFlow and Conventional Commits, ESLint, Prettier, `bun check` type checks, Bun coverage, the production build, Semgrep SAST, and Trivy dependency/secret scans. Coverage, build output, and SARIF reports are retained for seven days.
 
 Jobs that run project commands install Bun 1.4.3 with `scripts/install-bun.sh` (a checksum-verified download, no npm) and run their steps with a `PATH` that holds Bun but no Node. The job containers keep Node only for Gitea's checkout and artifact actions, which are JavaScript actions the runner executes itself; see the [activation guide](docs/gitea-actions.md#runners-and-permissions).
 
 Functional tests run with `bun test --isolate`; coverage is line-level only (Bun reports no branch or function data). The separate required benchmark job runs without coverage in a container limited to 3 GiB (JavaScriptCore has no heap-size flag, so this replaces the former 2 GiB Node heap cap) and keeps its 240-second hang guard, one warm-up and two measured repetitions of all seven scenarios. [#78](https://gitea.nessar.fr/nessar/vac-optimizer/issues/78) restored this gate after a complete local pass in 298.6 seconds; see [the measurements and hardware limits](docs/benchmark/issue-78.md). After [#302](docs/benchmark/issue-302.md) the local protocol takes about 41 seconds. Benchmark success is required for image publication and the aggregate `required` job. The lowered hang guard and tightened multipliers still need confirmation on the CI runners.
 
-The `required` job aggregates successful validation and expected image publication, accepting the image job's intentional skip for fork PRs and manual runs. Image jobs require successful validation and are limited to pushes and same-repository PRs. Registry credentials are confined to the publishing step.
+The `required` job aggregates successful validation and expected image publication, accepting the image job's intentional skip for fork PRs and manual runs. Image jobs require successful validation and are limited to pushes to `develop`, `main` and release tags, and same-repository PRs. Registry credentials are confined to the publishing step.
 
 Both protected branches still require `gitlab-to-gitea/ci-conversion-required` until the owner approves the first merge message and a successful Gitea PR run, then replaces the migration gate with the actual pull-request context for `required`. Local validation does not satisfy this status. Historical CI reports and artifacts remain in administrator rollback backups; the original configuration is retained in Git history.
 
@@ -271,7 +271,7 @@ The image publisher implements this tag contract in `gitea.nessar.fr/nessar/vac-
 
 | Trigger | Published image tags |
 | --- | --- |
-| Successful push to any branch | `branch-<normalized branch slug>` and `sha-<full commit SHA>` |
+| Successful push to `develop` or `main`, or same-repository PR | `branch-<normalized branch slug>` and `sha-<full commit SHA>` |
 | Explicit release tag `vX.Y.Z` | `vX.Y.Z` and `latest`, using the existing SHA image |
 
 For example, `feature/calendar` uses `branch-feature-calendar`; integration uses `branch-develop`. Preserve the previous slug normalization: lowercase the branch name, replace characters other than `a-z` and `0-9` with `-`, truncate to 63 bytes, and remove leading/trailing `-`. Choose branch names with distinct slugs. Only valid release tags can update `latest`. Automatic image publication and tag promotion begin after the owner provisions publisher credentials and validates publication permissions.

docs/gitea-actions.md

@@ -11,10 +11,13 @@ message.
 
 ## Jobs and triggers
 
-Every branch and tag push runs CI. Pull requests run on opening, reopening,
-synchronization, and title/body edits. Manual dispatch runs validation without
-publishing images. There is no schedule or deployment job in the preserved
-configuration; the Compose files remain manual deployment options.
+Pushes to `develop` and `main` and `v*` tag pushes run CI. Other branches
+(feature, renovate, release, hotfix) run it only through their pull request; a
+branch without a PR gets no automatic CI or image, so open a draft PR to get
+one. Pull requests run on opening, reopening, synchronization, and title/body
+edits. Manual dispatch runs validation without publishing images. There is no
+schedule or deployment job in the preserved configuration; the Compose files
+remain manual deployment options.
 
 | Job         | Behavior                                                                                                                                                                                                                                                                                                                                                        |
 | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -27,18 +30,19 @@ configuration; the Compose files remain manual deployment options.
 | `images`    | Publishes branch/SHA images after required validation, including the benchmark, or promotes an existing SHA image for a stable tag, running the publisher with Bun. Runs only for pushes and same-repository PRs.                                                                                                                                               |
 | `required`  | Fails on failed, cancelled, or skipped required validation, including the benchmark. Requires image publication when expected; accepts its intentional skip for fork PRs and manual dispatch. It is shell only and needs no Bun.                                                                                                                                |
 
-The benchmark runs on both push and pull_request events: the push run gates image
-publication (`images.needs` includes `benchmark`) and the `required` aggregate.
-The relative gate absorbs a slower runner and load that lasts through the whole
-job, because calibration runs in the same job. It calibrates before and after the
-protocol and judges against the slower value, so it also absorbs load that starts
-during the protocol, such as an overlapping push and pull_request run of the same
-commit. It does not absorb load that ends before the second calibration; the
-240-second hang guard still bounds those runs.
+The benchmark gates image publication (`images.needs` includes `benchmark`) and
+the `required` aggregate. The relative gate absorbs a slower runner and load
+that lasts through the whole job, because calibration runs in the same job. It
+calibrates before and after the protocol and judges against the slower value,
+so it also absorbs load that starts during the protocol, such as another run
+sharing the runner. It does not absorb load that ends before the second
+calibration; the 240-second hang guard still bounds those runs.
 
-Push and PR runs are separate so PR title and rebase checks run on the PR event.
-New runs cancel older runs for the same event/ref. Image jobs serialize per
-branch slug; stable promotions share one group and are not cancelled in progress.
+Because branch pushes outside `develop` and `main` do not trigger CI, a commit
+on a PR branch runs only on PR events, which carry the PR title and rebase
+checks. New runs cancel older runs for the same event/ref. Image jobs serialize
+per branch slug; stable promotions share one group and are not cancelled in
+progress.
 
 ## Runners and permissions
 
@@ -112,10 +116,10 @@ only one place fails CI instead of drifting.
 ## Images and releases
 
 Images use the [Gitea container registry](https://docs.gitea.com/usage/packages/container/)
-at `gitea.nessar.fr/nessar/vac-optimizer`. Branch pushes and same-repository PRs
-publish `branch-<slug>` and `sha-<full commit SHA>`. Slugs retain the previous
-lowercase, non-alphanumeric-to-hyphen, 63-byte normalization; choose distinct
-branch slugs.
+at `gitea.nessar.fr/nessar/vac-optimizer`. Pushes to `develop` and `main` and
+same-repository PRs publish `branch-<slug>` and `sha-<full commit SHA>`. Slugs
+retain the previous lowercase, non-alphanumeric-to-hyphen, 63-byte
+normalization; choose distinct branch slugs.
 
 Only stable `vX.Y.Z` tags matching the tagged commit's `package.json` version
 and reachable from `main` may promote images. Promotion first pulls the existing
@@ -148,7 +152,7 @@ secrets. Complete the remaining activation checks in this order:
    `git show 0d900fd72d1a405d257f5a566c55cc0cb3d2bc61:.gitlab-ci.yml`.
 2. Publish the reviewed feature branch and open its PR to register the workflow.
    Once registered, manual dispatch verifies validation and artifacts without
-   publishing images. Push and PR validation can also run now; their image and
+   publishing images. PR validation can also run now; its image and
    aggregate checks remain blocked until publisher secrets are provisioned.
 3. Verify runner isolation and Docker service support, then provision the two
    publisher secrets. Review the package publisher's permissions and registry