[codex] Restrict GitHub Actions triggers

[davidpayip]

Summary

• Restricts branch-based GitHub Actions triggers to development, test, and main.
• Removes security scan execution from promotion branches where applicable.
• Keeps test/main promotion workflows available without rerunning development security checks.

Validation

• Parsed all workflow YAML in the changed worktree with PyYAML.
• Ran the branch trigger policy scan and confirmed zero remaining branch/tag trigger violations in the targeted worktree.
• Ran agent-final-check where the base checkout was clean; dirty base checkouts were preserved and edited only through isolated worktrees.