CI/CD: check only pull requests into the branches you list

Add pull_requests: { branches: [main] } to the production branch's runtime.yml. A pull request into any other branch ends immediately, uses no machine, and its runtime run reads "Not checked" (action required, which never passes a required check). A pull request whose base branch changes is checked again. Without the list, every pull request is checked, as before.