Coverage CI: gate OPAM cache save to master pushes (codex P2)

actions/cache/save@v5 on cache miss runs on every event including
pull_request, which creates PR-scoped cache entries tied to
refs/pull/<n>/merge. Those entries aren't restorable by master or
other PRs, so they consume storage and can evict the shared
master-saved entry, reducing hit rate.

Restrict the save to push events on refs/heads/master, matching the
pattern already used for the coverage-build-state cache. PRs still
benefit from full restore via the latest master cache; they just
don't write new entries.

Flagged by Codex review on #8434.

Author: JonoPrest

.github/workflows/coverage.yml

@@ -118,8 +118,12 @@ jobs:
         if: steps.cache-opam-env.outputs.cache-hit != 'true'
         run: opam install . --deps-only --with-test --with-dev-setup
 
+      # Only save on master pushes. PR-scoped caches are tied to
+      # refs/pull/<n>/merge and can't be restored by master or other PRs,
+      # so they'd just consume storage and evict the shared entry. PRs
+      # still get full restore from the latest master-saved cache.
       - name: Save OPAM environment
-        if: steps.cache-opam-env.outputs.cache-hit != 'true'
+        if: steps.cache-opam-env.outputs.cache-hit != 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
           path: |