Test+zizmor run on both main pushes and tag pushes. Build only fires
on tags. ci.fnl now pushes refs/heads/main and the tag in one git push.

Assisted-by: GLM-5.1 via pi

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 400f548..45a4eaf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,8 @@
 name: CI
 
-on: # zizmor: ignore[dangerous-triggers] -- only triggers on tag pushes from Gitea mirror; no fork PR risk.
+on:
   push:
+    branches: [main]
     tags: [v*]
 
 permissions: {}
@@ -42,9 +43,10 @@ jobs:
           persist-credentials: false
       - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
 
-  build:
-    name: Build
+  release:
+    name: Release
     needs: test
+    if: github.ref_type == 'tag'
     runs-on: ubuntu-latest
     permissions:
       contents: write # create GitHub release.
diff --git a/.quire/ci.fnl b/.quire/ci.fnl
index e2388ba..f990592 100644
--- a/.quire/ci.fnl
+++ b/.quire/ci.fnl
@@ -22,4 +22,5 @@
                   :push
                   :--porcelain
                   mirror-url
+                  :refs/heads/main
                   (.. :refs/tags/ tag)] git-opts))))))