ci.yml push gates

Always force full code and Hermes CI on pushes to main and release/**, and run actionlint unconditionally so workflow defects cannot evade validation through path filters. Chose this over universal PR gating because the external real-Hermes ABC check is expensive and unrelated to most changes; on pull requests, restrict Hermes to packages/hermes/** and .github/workflows/ci.yml.