chore(ci): stop release and CodeQL runs on PRs, drop deploy smoke tests

The release matrix (7 Linux cross-builds + a CGO Windows build) ran on every
PR and on every branch push, so a PR from a repo branch built everything
twice. Release binaries now build only on main (dev channel) and version
tags; any other branch can still be built via workflow_dispatch.

CodeQL keeps its push-to-main and weekly scans but no longer runs per PR.

The deploy smoke workflow fired on every Release completion only to skip
its jobs; deploy/test/smoke-noninteractive.sh stays for manual runs.

.github/workflows/codeql.yml

@@ -11,12 +11,6 @@ on:
       - "go.mod"
       - "go.sum"
       - "frontend/**"
-  pull_request:
-    paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
-      - "frontend/**"
   schedule:
     - cron: "18 2 * * 2"
 
@@ -24,8 +18,6 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    env:
-      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: true
     permissions:
       security-events: write
       packages: read