CI: drop the pull_request trigger

The self-hosted runner allows privileged containers; a fork's pull
request could otherwise run its own workflow with root on that machine.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,9 +1,11 @@
 name: CI
 
+# Only pushes to this repository, no pull_request: the runner allows privileged
+# containers, and a pull request from a fork could otherwise run its own
+# workflow with root access on the runner machine.
 on:
   push:
     branches: ["**"]
-  pull_request:
 
 jobs:
   test-bookworm: