ci: Add pull_request trigger to CI workflow

- Add pull_request trigger for PRs against master
- Add 'if: github.event_name == push' to build/deploy/publish jobs
- Test jobs (go-test, node-test) now run on both push and PRs
- Build/deploy/publish only run on push to master

This fixes the chicken-and-egg problem where branch protection requires
CI checks but CI doesn't run on PRs. Now PRs get test validation before
merge while keeping production deployments only on master pushes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/deploy.yml

@@ -8,6 +8,13 @@ on:
       - 'LICENSE'
       - '.gitignore'
       - 'docs/**'
+  pull_request:
+    branches: [master]
+    paths-ignore:
+      - '**.md'
+      - 'LICENSE'
+      - '.gitignore'
+      - 'docs/**'
 
 concurrency:
   group: deploy
@@ -270,6 +277,7 @@ jobs:
   # ───────────────────────────────────────────────────────────────
   build:
     name: "🏗️ Build Docker Image"
+    if: github.event_name == 'push'
     needs: [go-test]
     runs-on: self-hosted
     steps:
@@ -294,6 +302,7 @@ jobs:
   # ───────────────────────────────────────────────────────────────
   deploy:
     name: "🚀 Deploy Staging"
+    if: github.event_name == 'push'
     needs: [build]
     runs-on: self-hosted
     steps:
@@ -338,6 +347,7 @@ jobs:
   # ───────────────────────────────────────────────────────────────
   publish:
     name: "📝 Publish Badges & Summary"
+    if: github.event_name == 'push'
     needs: [deploy]
     runs-on: self-hosted
     steps: