Exercise artifact transfer without duplicate pull request runs

[latheiere]

Summary

• restrict branch-push CI runs to the default branch while retaining pull request validation
• upload built distributions and download them into a separate directory before metadata checks and installation
• retain CI artifacts for one day to minimize storage use

Rationale

Same-repository pull request branches currently match both the unrestricted push trigger and the pull_request trigger, causing every job to run twice. Release artifact actions also execute only during publishing, so dependency upgrades to the artifact-transfer path are not exercised before a release.

This change gives pull request branches one CI run and validates the same upload/download boundary used by publishing without invoking package publication.

Validation

• make check
• lint and formatting checks
• strict type checking
• 59 tests with 92.36% coverage
• source and wheel builds
• package metadata checks

The pull request workflow will additionally exercise the hosted artifact-transfer path.