docs(ci): state the measured push-CI model in ci.yml's when-comment

The old comment said push CI is restricted to "protected branches (main)",
which implied next lacked post-merge verification. next is protected and the
default branch since 2026-08-19, and it is not unverified: publish.yml's
verify step runs the complete mandatory set on every push to next, mirroring
this pipeline step-for-step (enforced by verify-release.test.mjs). The
postgres run and push-ci status context it does not re-run duplicate
pre-merge coverage, since PR CI tests the merge ref whose tree equals the
squash commit. Measured 2026-08-19: the 21 most recent push events on next
each ran exactly one pipeline (publish), zero ci. No behavior change.

.woodpecker/ci.yml

@@ -7,11 +7,20 @@ variables:
   - &enable_pnpm 'corepack enable'
 
 when:
-  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
+  # PR + manual CI run on any branch: the pull_request pipeline is the merge
-  # push CI is restricted to protected branches (main) so a feature-branch push no
+  # gate (required status check on next; next is protected and the DEFAULT
-  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
+  # branch since 2026-08-19).
-  # CI load on the storage-constrained runner with zero loss of gating (branch
+  # Push CI runs on main only. next deliberately runs NO push ci: post-merge
-  # protection requires no push/ci status context; main still gets full push CI).
+  # verification on next is carried by publish.yml's `verify` step
+  # (pnpm verify:release), which mirrors this pipeline's complete mandatory
+  # set step-for-step, enforced by scripts/verify-release.test.mjs. The two
+  # things push-to-next does not re-run, the postgres-path test and a
+  # push-ci status context, duplicate pre-merge coverage: PR CI tests the
+  # merge ref, whose tree equals the landed squash commit. Measured
+  # 2026-08-19: the 21 most recent push events on next each ran exactly one
+  # pipeline (publish), zero ci.
+  # Keeping push ci off next also avoids a redundant second full-suite run
+  # per merge on the storage-constrained runner.
   - event: [pull_request, manual]
   - event: push
     branch: main