security: remove pull_request trigger from ha-build.yml

ha-build.yml runs on self-hosted k3s runners. Having pull_request as a
trigger allows any internet user to open a PR against this public repo
and execute arbitrary code on cluster nodes (GitHub does block secret
injection on fork PRs, but runner filesystem and cluster network access
remain).

Removed pull_request trigger. Build-on-push-to-main is sufficient.
CI test feedback on PRs is covered by ci-tests.yml which uses
GitHub-hosted (ubuntu-latest) runners only.

.github/workflows/ha-build.yml

@@ -8,7 +8,10 @@ on:
       - "feat/ha-*"
       - "feat/phase*"
       - "copilot/*"
-  pull_request:
+  # pull_request intentionally removed: this workflow runs on self-hosted k3s
+  # runners. Allowing pull_request events from a public repo would let any
+  # internet user execute arbitrary code inside the cluster network.
+  # CI build feedback on PRs is provided by ci-tests.yml (GitHub-hosted runners).
 
 # Cancel in-progress runs when a new push arrives on the same branch.
 concurrency: