Send branch pushes to CI for predeployment scans

Your repository push events land unfiltered in CI and cause missed or delayed security scans and tech debt checks. Builds and scans run on the correct branch so developers see findings before the next deployment window.