ci: run tests and phpstan on pull requests

[danielebarbaro]

Problem

run-tests.yml and phpstan.yml both trigger on push only:

on:
  push:
    paths:
      - '**.php'

No pull_request. For a branch pushed to this repository the checks still show up, because the push itself fires them. But:

• A pull request from a fork runs nothing. No tests, no static analysis. The contributor sees a green PR page with no checks on it, and the code is only exercised after it has already been merged into main.
• The checks report on the wrong side of the decision. They tell you the branch was fine when it was pushed, not that the merge result is fine.

That second point has teeth here because of dependabot-auto-merge.yml:

on: pull_request_target
# ...
- name: Auto-merge Dependabot PRs for semver-minor updates
  run: gh pr merge --auto --merge "$PR_URL"

Every semver-minor and semver-patch bump is queued for auto-merge. --auto waits for whatever checks branch protection makes required — and a workflow that never runs on the pull request cannot be a required check on it. So dependency updates can land on main without a single test having run against them.

Fix

Add pull_request to both workflows, with the same path filters.

push is narrowed to branches: [main] at the same time. Without that, pushing to a branch that already has a PR open fires both triggers and runs the 16-job matrix twice for nothing. With it: pull requests are tested before merge, main is tested after, and nothing runs twice.

Deliberately unchanged

fix-php-code-style-issues.yml stays on push only. It commits its fixes back with stefanzweifel/git-auto-commit-action, which needs write access to the branch — it cannot push to a fork's branch, so running it on pull_request would just fail, and pull_request_target would mean checking out and running untrusted code with a writable token. Formatting on main after merge is the right place for it.

Still needs doing by hand

This PR makes the checks run on pull requests. It cannot make them required — that is branch protection on main, configured in the repository settings, not in a workflow file. Until run-tests and phpstan are marked as required status checks there, gh pr merge --auto has nothing to wait for and the dependabot auto-merge gap stays open.

Worth considering separately: a concurrency group keyed on the ref, so pushing twice to a PR cancels the superseded run instead of leaving 16 jobs to finish. Left out here to keep the diff to the triggers.

Verified

Both files pass yaml-lint. No job definitions touched, only the on: blocks.