fix(release): restore the push trigger — wheels build on every commit again

I broke the thing that made past releases work. The proven workflow runs on
every push to main, not only on tags:

    on:
      push:
        branches: [main, master]
        tags: ["v*", "ci-*", "test-*"]
      pull_request: {}
      workflow_dispatch: {}

I had narrowed it to tags-only, which removed continuous wheel validation and
is why the Build check vanished from the push checks. That is exactly backwards:
building all 15 wheels on every commit is *why* tagging previously "just
worked" - the wheels were already proven by the time a tag existed, so the tag
run had nothing left to discover.

Restored verbatim, along with the original job name (`Build`) so the check reads
as it always has.

Also gated dependency-gate to tag pushes. dependency-audit.yml already runs
non-strict on every push as its own check; calling it again from here would
duplicate that on every commit. It earns its place at release time, where strict
turns an advisory into a hard block - which is what caught RUSTSEC-2026-0204.

Publish remains tag-only, so pushes build and verify but cannot publish.

Author: Guillaume Lessard

.github/workflows/release-build.yml

@@ -1,4 +1,4 @@
-name: release-build
+name: Build
 
 # Restored from the workflow that actually published v0.6.5 -> v0.6.9
 # (preserved at the v0.6.9 checkout). The v0.7.0 prep commit 3d332eb replaced
@@ -29,8 +29,9 @@ name: release-build
 
 on:
   push:
-    tags:
-      - "v*"
+    branches: [main, master]
+    tags: ["v*", "ci-*", "test-*"]
+  pull_request: {}
   workflow_dispatch: {}
 
 permissions:
@@ -170,6 +171,11 @@ jobs:
   # RUSTSEC-2026-0204 before it could ship.
   dependency-gate:
     name: Dependency + licence gate
+    # Tag pushes only. dependency-audit.yml already runs non-strict on every
+    # push as its own check; running it again here would duplicate that on every
+    # commit for no benefit. It matters at release time, where strict turns an
+    # advisory into a hard block - which is what stopped RUSTSEC-2026-0204.
+    if: startsWith(github.ref, 'refs/tags/v')
     uses: ./.github/workflows/dependency-audit.yml
     with:
       strict: true