Keep image retention checks on main updates only

.gitea/workflows/wiki-image-retention-checks.yml

@@ -1,13 +1,5 @@
 name: Wiki image retention checks
 on:
-  pull_request:
-    paths:
-      - 'scripts/wiki-image-lifecycle.py'
-      - 'scripts/deploy.sh'
-      - 'tests/test_wiki_image_lifecycle.py'
-      - '.gitea/workflows/wiki-image-retention-checks.yml'
-      - '.gitea/workflows/waterfall-wiki.yml'
-      - 'Dockerfile'
   push:
     branches: [main]
     paths:
@@ -16,6 +8,7 @@ on:
       - '.gitea/workflows/wiki-image-retention-checks.yml'
 jobs:
   retention-policy:
+    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
     runs-on: ces-control
     timeout-minutes: 5
     steps:

docs/wiki-image-retention.md

@@ -54,6 +54,8 @@ the original build/deployment status or rolling back healthy services. Reference
 images and Docker refusal are reported and retained. Failed CI does not record a
 successful release and does not immediately remove that job's test image.
 
-PR checks run Python policy tests and shell syntax checks on ces-control without
-building or touching Docker. The existing full build/integration/deployment runs
-only after the user merges to main. No local builds are needed.
+After the user merges to main, policy checks run Python tests and shell syntax
+checks on ces-control without building or touching Docker. The full application
+build/integration/deployment also runs only on main updates, subject to its path
+filters. PR events and manual dispatch do not trigger either workflow. No local
+builds are needed.