ci: run the check job on pull requests

A PR never got a CI run: the workflow triggered only on push to main
and on tags, so the risk/medium+ PR lane merged on local task check
alone (PR #66). pull_request now runs Lint/Test/Vet on the PR head;
build is gated to push and deploy already was, so a PR builds no
image, writes nothing to infra and sees no secrets.

Closes #68

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -8,6 +8,12 @@ name: CD
     # (Only applies to branch pushes; tag pushes always trigger.)
     paths-ignore:
       - 'docs/**'
+  # gitea-mcp#68: without this a PR never got a CI run, so the risk/medium+
+  # PR lane merged on local `task check` alone. Only the check job runs for a
+  # PR -- build and deploy stay push/tag-only (no images, no infra writes,
+  # no secrets from a PR).
+  pull_request:
+    branches: [main]
 
 env:
   IMAGE: gitea-mcp
@@ -44,6 +50,7 @@ jobs:
   build:
     name: Build & Import
     needs: check
+    if: github.event_name == 'push'
     runs-on: self-hosted
     outputs:
       image-tag: ${{ steps.meta.outputs.sha-tag }}