ci: restrict guix build to only run on tagged pushes and labeled PRs

Previously, the Guix Build workflow triggered on all push events
(branches and tags), relying solely on the job-level `if` condition
to skip non-tag branch pushes. This caused unnecessary workflow runs
to appear (as skipped) on every PR push.

Restrict the push trigger to tags only, so the workflow is never
triggered by regular branch pushes. The existing job-level condition
is kept as defense-in-depth.

For PRs, the workflow continues to require the `guix-build` label.

Author: thepastaclaw

.github/workflows/guix-build.yml

@@ -9,6 +9,8 @@ on:
   pull_request_target:
     types: [labeled]
   push:
+    tags:
+      - '*'
   schedule:
     # Run weekly at 3 AM UTC on Sunday on the default branch
     - cron: '0 3 * * 0'