Limit compile-workflows trigger to pull_request only

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>

.github/workflows/compile-workflows.yaml

@@ -5,10 +5,6 @@ on:
     branches: ["main"]
     paths:
       - ".github/workflows/*.md"
-  push:
-    branches: ["main"]
-    paths:
-      - ".github/workflows/*.md"
 
 jobs:
   compile:
@@ -16,19 +12,12 @@ jobs:
     runs-on: ubuntu-latest
     # Skip fork PRs: secrets are unavailable, and we should not compile
     # untrusted .md content from a fork and push it back.
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
+    if: github.event.pull_request.head.repo.fork == false
     permissions:
       contents: read  # checkout; push uses GH_PAT explicitly
 
     steps:
-      - name: Checkout (push)
-        if: github.event_name == 'push'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          token: ${{ secrets.GH_PAT }}
-
-      - name: Checkout (PR head branch)
-        if: github.event_name == 'pull_request'
+      - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.head_ref }}