Run CI on every pull request, not only those targeting main

[mikelangmayr]

• Drop the branches: [main] filter from both workflows' pull_request trigger. That filter matches the base branch, so a PR stacked on another feature branch got no checks at all, which is exactly when they are most wanted. Found while stacking the keygrabber work: Add the keygrabber control keywords and a testable scheduler #34 reported "no checks reported" purely because its base was a feature branch
• Keep the paths filters and the push-only-on-main trigger, so this widens which PRs are checked without widening what triggers a build
• Move the docs workflow's pages concurrency group from the workflow onto the deploy job. It exists to stop two publishes overlapping, but at workflow scope it also serialized every PR's docs build behind every other one, which matters more now that more PRs build. Deploys still run one at a time and are still never cancelled mid-publish