Limit push trigger to main in code-coverage workflow

Same fix as check-recent: push: branches: '**' caused the workflow to
run twice per PR commit (once for push, once for pull_request). Restricting
push to [main] ensures coverage runs only once per PR update.

https://claude.ai/code/session_01XHWLohiSTdZvCutwD7ag2b

.github/workflows/codecovr.yaml

@@ -28,10 +28,12 @@
 # ==================================================================== #
 
 on:
-  push:
-    branches: '**'
   pull_request:
+    # run on every PR update (once per push)
     branches: '**'
+  push:
+    # only on main; PR pushes are already covered by pull_request above
+    branches: [main]
 
 name: code-coverage