ci: run commitlint once per same-repo PR (#4795)

Scope the push trigger to the default branch so Renovate (and any other
same-repo branch) fires only the pull_request event instead of both push
and pull_request, which currently runs the Commitlint check twice for a
single PR.

Coverage improves rather than regresses: the pull_request path validates
the full commit range (--from base --to head), whereas the dropped push
run only checked --last (the tip commit). Direct pushes/merges to master
still run the --last validation, and fork PRs were already single-run.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>