fix: restrict PyPI publish to push events on main

Gate publish workflow on workflow_run.event == 'push' so scheduled CI
runs no longer trigger daily releases. Only merges/pushes to main now
publish a new version.

Author: JE-Chen

.github/workflows/publish-pypi.yml

@@ -16,10 +16,11 @@ jobs:
     # gate strictly on the main branch and check out the exact commit
     # that passed CI, avoiding any race with a later push to main and
     # ensuring no fork-originated ref is ever materialised here.
+    # Restrict to `push` events so scheduled CI runs do not publish.
     if: >-
       ${{ github.event.workflow_run.conclusion == 'success'
           && github.event.workflow_run.head_branch == 'main'
-          && github.event.workflow_run.event != 'pull_request' }}
+          && github.event.workflow_run.event == 'push' }}
     runs-on: ubuntu-latest
 
     steps: