preview-netlify, preview-cloudflare: install the deploy CLI only on pull_request runs

[quantecon-services]

This is the #92 Phase 1 item "gate both preview actions' CLI installs on pull_request". #92 handed it to #105, but #105 closed on 2026-09-24 (shipped in v0.12.0) without it, so nothing tracked it.

What's wrong. On main @ 64aeb2f:

• Both Install … CLI steps (preview-netlify/action.yml:56-58, preview-cloudflare/action.yml:68-70) run on if: steps.check-trust.outputs.skip != 'true' alone.
• The deploy steps they feed (preview-netlify/action.yml:92-95, and the matching step in preview-cloudflare) also require github.event_name == 'pull_request'.

So a workflow_dispatch run, which both current consumers allow, spends time on npm ci of the pinned CLI and then skips the deploy. #92 measured the install at roughly 25–45 s.

Fix.

• Add && github.event_name == 'pull_request' to both install steps' if:, keeping the trust check (fix(preview): surface deploy errors, pin CLIs, remove unsafe fork guidance #105's fork guard).
• Check that nothing downstream reads steps.install-cli.outputs.bin on a non-pull_request run. The deploy and comment steps are already gated.
• Harness: the preview-cli-install job added in fix(preview-*): surface deploy errors, pin the CLIs by lockfile, keep the Netlify token off argv (#105) #174 runs the install on its own. Make sure it still exercises the install after the gate is added.
• CHANGELOG [Unreleased] entry. It is behaviour-visible only as a faster no-op run.

Related: #143, item 2, the release-gate spike. It checks the same pull_request gates, from the question of whether a non-PR gate run is silently green.