ci: run repo checks only on pull requests

[jacderida]

Part of a six-repo change (V2-1353) making repo CI run on pull requests only.

• Drop the push: trigger from wasm.yml

That was this repo's only off-PR CI trigger: merge.yml and pr-checks.yml were already
pull_request-only, and release.yml is workflow_dispatch. The WASM portability checks were
re-running on main against commits that had already passed them on their PR.

Linear issue

Closes V2-1353

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

No crate source changes — only .github/workflows, so this needs no version bump of its own.

Test evidence

T0: repo CI only.

• wasm.yml still parses and keeps its pull_request trigger, so the same four cargo check /
  cargo test steps still run on every PR.
• The default branch is main, so nothing that ran on a push escaped the PR run.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert this commit; the triggers come back exactly as they were. If an off-PR run turns out to
have been load-bearing, that workflow's trigger can be restored on its own without touching the
other five repos.

🤖 Generated with Claude Code

[dirvine]

Reviewed by Hermes Agent (dirvine identity), per <@UDK3BBUE8>'s request.

CI-only change, verified against head b549b6f:

• wasm.yml: removes the push trigger on main/master/web-support; pull_request trigger unchanged.

No source changes, no secrets. CI on head: fully green (builds all three OSes, fmt, clippy, wasm, dry-run publish, tests).