ci: make the governance pipeline PR-only

[robsongajunior]

Summary

• Remove the `push: main` trigger from the Governance Pipeline: the Governance Gate is a required check with strict up-to-date enforcement, so the exact tree that lands on main already passed on the PR — the post-merge rerun was pure duplication.
• Drop the release-please skip condition from ci: skip the governance rerun on release-please merges #869 (dead code without a push trigger) and simplify `concurrency` to the PR-only form.
• Point the README badge at PR runs (`?event=pull_request`) — `?branch=main` would freeze on the last pre-change run forever.

How to test

1. On this PR, open the Checks tab: the Governance Pipeline runs on the `pull_request` event and Governance Gate reports on the head SHA (the required check that gates the merge).
2. After merging, watch the Actions tab filtered by `main`: no Governance Pipeline run appears for the merge push (before, every merge reran the full pipeline; ci: skip the governance rerun on release-please merges #869 only skipped release-please merges).
3. Check the README badge: it links and renders from the latest `pull_request` run.

Notes

• None