chore: slim CI gate to test+typecheck, drop redundant main push trigger

[xhqing]

What

• CI validate job reduced to: checkout -> setup-bun -> bun install --frozen-lockfile -> bun test -> typecheck
• Removed setup-node, p7zip, release:build (downloads official runtime), release:pack, npm metadata check — full build/pack verification stays in the publish workflow
• Removed the on: push: branches: [main] trigger (pull_request + workflow_dispatch remain) — under strict required checks + enforce_admins, the PR gate already guarantees main stays green, so the post-merge re-run was redundant and doubled the flaky-test noise exposure

Why

• Measured: one CI run took 4m20s, 90% of it in release:build (runtime download) which is release preparation, not regression gating
• Same-day incident: smoke test flipped green-on-PR / red-on-main randomly (flaky), proving the double-run doubles noise without adding protection

Notes

• Job name stays validate so the branch protection required check needs no change
• Expected gate time after merge: ~2min