ci: run conformance tests on pushes to main

[wangyb-A]

Summary

Adds a push trigger for the main branch to the Conformance Tests workflow so the suite also runs after commits land on main, not only on pull requests.

Change

Under on:, a push: { branches: ["main"] } trigger is added immediately before the existing pull_request trigger.

Behavior

• Conformance now runs on every push to main (e.g. after a PR merges), providing post-merge validation of the integrated state.
• The existing pull_request trigger and its paths filters are unchanged, so PR-time path filtering behaves exactly as before.
• workflow_dispatch, concurrency, and all jobs are untouched.

Note: the push trigger intentionally has no paths filter, so any push to main runs the suite.

[github-actions]

Codex AI review

No actionable findings. Residual risk is limited to GitHub Actions runtime behavior; repository code was not executed as required.

Reviewed commit b75570d92b4301978a979722fd15085caca9fdf2. Workflow run

[github-actions]

Claude AI review

No actionable findings. This PR adds a push: { branches: ["main"] } trigger to .github/workflows/conformance-tests.yml so the conformance suite also runs after commits land on main.

The change is correct: the YAML is valid, same-repo push events have access to the required secrets and id-token: write for AWS OIDC, and AWS_REGION falls back to us-west-2 since github.event.inputs is undefined outside workflow_dispatch. The existing global concurrency lock (conformance-tests-global, cancel-in-progress: false) already serializes runs against the shared per-suite CloudFormation stacks, so a post-merge push run safely queues behind any in-flight PR run rather than colliding on the shared --no-cleanup stacks. The pull_request trigger and its paths filter are unchanged.

Residual (non-blocking) risk, not a defect:

• The push trigger deliberately has no paths filter (called out in the PR description), so the full conformance suite — which deploys real AWS infrastructure and holds the repo-wide serialized lock — now runs on every push to main, including doc-only or unrelated-package changes. This increases cost and queue contention on the global lock.
• With cancel-in-progress: false and a static concurrency group, only one run can be pending at a time; rapid successive pushes to main can cause an earlier queued run to be superseded by a newer one, so not literally every push completes a conformance run. If per-push post-merge validation matters, consider mirroring the pull_request paths filter on the push trigger.

Reviewed commit b75570d92b4301978a979722fd15085caca9fdf2. Workflow run