ci: BI-7421 trigger main.yml on push to main only

[ovsds]

Summary

• Drop pull_request_target and workflow_dispatch PR scaffolding from .github/workflows/main.yml. Triggers reduce to push on main + workflow_dispatch.
• Robot syncs commits directly to `main`, so the fork-PR safety jobs (`drop-ci-approved-label`, `check-ci-allowed`, `check-skip-tests-label`) and `ci-approved`/`tests-force-skipped` label flow no longer apply — removed.
• All checkouts drop the `ref:` / `repository:` overrides (defaults to the push ref).
• `router`: base SHA comes from `github.event.before` for push (falls back to `origin/main` for manual dispatch); head SHA is `github.sha`.
• `concurrency` group keyed on `github.sha` so every commit gets its own run (cancellation only applies to re-runs of the same commit).

Part of BI-7421. Unblocks failure notifications and BI-7423 (release-any-commit).

Follow-ups (separate PRs, not in this one):

• `.github/.scripts/gh_user_check_permission.sh` and `gh_pull_request_check_label.sh` are now orphaned — delete in a cleanup PR.
• `terrarium_check.yaml` still has `pull_request` trigger; same simplification later.
• `validate-pr-name.yml`, `request-copilot.yaml` — decide fate when fork-PR story is settled.

Test plan

• Merge → first push to `main` triggers the workflow and runs all jobs end-to-end (image build, router, pytest split, mypy, codestyle).
• Verify `router` correctly diffs `github.event.before`..`github.sha` (changed-packages output non-empty when the synced commits touched `lib/` or `app/`).
• Verify `workflow_dispatch` with `run_for_all_packages=true` still tests everything.
• Verify `workflow_dispatch` with `skip_tests=true` skips pytest jobs.