Merge pull request 'ci: 仅 main 分支执行 CI/CD' (#1) from codex/main-only-cicd into main

Reviewed-on: #1

.gitea/workflows/README.md

@@ -1,5 +1,5 @@
 # Hestia Server workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes and manual dispatch from main. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 [deploy.yml](deploy.yml) is main-only and manual-only. It repeats verification, builds the runtime image, then runs the existing deployment script. Production resource names, paths, lock and database mounts remain unchanged.

.gitea/workflows/ci.yml

@@ -3,11 +3,11 @@ name: Verify Hestia server
 on:
   push:
     branches: [main]
-  pull_request:
   workflow_dispatch:
 
 jobs:
   verify:
+    if: gitea.ref == 'refs/heads/main'
     runs-on: ces-control
     timeout-minutes: 60
     env: