ci: validate integrated main after merges

[postigodev]

Summary

The validation workflow currently runs for pull requests and v* tag pushes, but not for ordinary pushes to main.

Why this matters

Each PR can pass CI independently while the integrated state of main still breaks after several merges. The repository should have a green source of truth for the actual branch users and future PRs build from.

Expected outcome

Run the non-release validation path on pushes to main without triggering installer packaging or publishing.

Acceptance criteria

• add push.branches: [main] (or equivalent) to the workflow trigger
• plan / validate checks run on main
• Windows installer build and release publication remain tag-only
• release identity validation must not treat a normal main push as a release tag
• preserve current pull-request validation behavior

Likely files

• .github/workflows/release.yml