improve workflow gating

Author: bpatrik

.github/workflows/build.yml

@@ -139,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build-verify-docker]
     # Only push on branch merges or tags, never on plain PRs
-    if: github.event_name != 'pull_request'
+    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/experimental'
     strategy:
       matrix:
         container: [alpine, debian-trixie]