integration-macos: dispatch-only (drop push-to-main trigger)

Make the advisory macOS Apple Container job run on workflow_dispatch
only, removing the push-to-`main` trigger so a single non-redundant
laptop never runs unattended on every push. Updates the job comment,
docs/ci.md, README CI note, and the PRD accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ci.md

@@ -8,7 +8,7 @@ It runs the unit suite plus one integration job per backend
 - every push to `main`.
 
 `integration-macos` is the exception: it is **advisory**, running only on
-push-to-`main` and `workflow_dispatch`, never on pull requests. It targets the
+`workflow_dispatch` (manual dispatch), never on push or pull requests. It targets the
 Apple Container backend on a self-hosted macOS runner (label `macos`,
 registered in host mode — Apple Container can't run in a Linux container, so it
 can't reuse the `kvm` runner). A single non-redundant laptop must not be able

docs/prds/prd-new-macos-container-ci-runner.md

@@ -57,10 +57,12 @@ plugs into; this PRD supplies the runner and the job.
 
 ## Non-goals
 
-- Making `integration-macos` a **required** PR check. It runs on push-to-main
-  and `workflow_dispatch` only. A single non-redundant laptop that sleeps and
-  roams must never be able to block a PR merge, and it is deliberately kept out
-  of the `coverage` job's `needs` so the diff-coverage gate never depends on it.
+- Making `integration-macos` a **required** PR check. It runs on
+  `workflow_dispatch` (manual dispatch) only — never on push or PRs. A single
+  non-redundant laptop that sleeps and roams must never be able to block a PR
+  merge or churn unattended on every push to main, and it is deliberately kept
+  out of the `coverage` job's `needs` so the diff-coverage gate never depends on
+  it.
 - Multi-machine or hosted macOS runners. Apple Container needs the host
   virtualization framework, so the runner must be a physical/VM macOS host on
   Apple Silicon — it cannot reuse the KVM runner or run in a Linux container.
@@ -91,8 +93,8 @@ plugs into; this PRD supplies the runner and the job.
 Modeled on `integration-firecracker`:
 
 - `runs-on: [self-hosted, macos]`.
-- `if:` push-to-main OR `workflow_dispatch` only (advisory; never PRs, so no
-  fork-PR exposure and no merge-blocking).
+- `if:` `workflow_dispatch` only (advisory, manual dispatch; never push or PRs,
+  so no fork-PR exposure, no merge-blocking, and no unattended runs on push).
 - `concurrency: { group: integration-macos-infra, cancel-in-progress: false }`
   to serialize runs against the singleton.
 - **Preflight** — `command -v container`, `container system status`, then