ci: avoid duplicate and mutating lint runs

[GACLove]

Summary

• run the push-triggered lint workflow only for main
• keep pull_request linting for feature branches
• remove Ruff --fix from pre-commit so CI reports violations without rewriting files

Trigger behavior

• feature branch with PR: one pull_request lint run
• direct push to main: one push lint run
• merged PR: a pull_request run before merge and a main push run after merge

Validation

• both YAML files parse successfully
• git diff --check passes
• GitNexus change scan: 2 config files, 0 code symbols, LOW risk