Merge pull request 'ci: 仅 main 分支执行 CI/CD' (#1) from codex/main-only-cicd into main

Reviewed-on: #1

.gitea/workflows/README.md

@@ -1,6 +1,6 @@
 # Tessera GUI workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes and manual dispatch from main. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 There is no production service deployment in this workflow.
 
@@ -21,17 +21,16 @@ fractional scale, multiline bounds, Unicode truncation and antialiased opacity.
 ## Incremental verification
 
 Gitea 1.26 concurrency groups cancel superseded runs on the same ref. Markdown-only
-pushes and pull requests skip verification; executable Endor examples and Rust
+pushes to main skip verification; pull requests do not trigger this workflow; executable Endor examples and Rust
 files (including embedded guide strings) still trigger checks. Manual dispatch
-always runs verification. Existing queued runs created from older workflow
+runs verification only when main is selected. Existing queued runs created from older workflow
 revisions retain their old behavior.
 
 The workflow invokes [verify-ci.sh](../../scripts/verify-ci.sh). Docker builds the
 Rust 1.91.1/system/font toolchain from Dockerfile.ci over stdin, without sending a
 source build context. The checkout is mounted read-only at /build. Named volumes
 persist Cargo registry/git downloads and /cargo-target across container removal,
-including failed tests and cancelled runs. Main/manual runs and each PR have
-separate cache scopes. Changing Rust/toolchain compatibility requires updating
+including failed tests and cancelled runs. Main push and manual runs use the main cache scope. Changing Rust/toolchain compatibility requires updating
 the image and cache prefix in the script. Cargo lockfiles and fingerprints decide
 which dependencies/artifacts are reusable; caches do not bypass checks.
 

.gitea/workflows/ci.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches: [main]
     paths-ignore: ["**/*.md"]
-  pull_request:
-    paths-ignore: ["**/*.md"]
   workflow_dispatch:
 
 concurrency:
@@ -14,6 +12,7 @@ concurrency:
 
 jobs:
   verify:
+    if: gitea.ref == 'refs/heads/main'
     runs-on: ces-control
     timeout-minutes: 60
     env: