Enable CI checks on PRs from forks with security hardening

[Copilot]

• Analyze current CI workflow configuration
• Add pull_request trigger to ci.yml workflow
• Ensure deploy job only runs on main branch pushes
• Update .gitignore to exclude actionlint binary
• Add cache poisoning protection (prevent forks from writing to cache)
• Scope permissions to minimum required (move elevated permissions to deploy job only)
• Fix duplicate workflow runs by restricting push events to main branch
• Test and validate the changes

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[SnO2WMaN]

@copilot

Build projectがPRが来たとき pull_request と push の両方走ってしまっていてよくない．適切に修正してほしい．

[Copilot]

@copilot

Build projectがPRが来たとき pull_request と push の両方走ってしまっていてよくない．適切に修正してほしい．

Fixed in commit 959e821. The push trigger is now restricted to only the main branch, so PRs will only trigger the pull_request event and won't run duplicate builds.