Changes: - Add 'pull_request' trigger (test-only on PRs) - Separate 'test' job (npm ci + npm test) - Separate 'build-push' job with condition: push to main only - Remove redundant Node.js install in push job - Proper dependency chain: test → build-push on main Now: PRs run tests without pushing. Main pushes build image to registry.