Restrict self-hosted runner job to trusted events only

[Copilot]

Any user can open a fork PR and trigger the real_hardware_test_on_self_hosted_runner job, which checks out PR code and runs it on the self-hosted runner — a direct code execution risk on the host machine.

Changes

• Scope push trigger to ch55xduino branch and add workflow_dispatch; pull_request remains for hosted-runner jobs
• Gate the self-hosted job with a job-level if: so it only runs on push or workflow_dispatch — never on PR events
• Add permissions: contents: read at workflow level to minimize GITHUB_TOKEN scope

on:
  pull_request:
  push:
    branches:
      - ch55xduino
  workflow_dispatch:

permissions:
  contents: read

jobs:
  real_hardware_test_on_self_hosted_runner:
    # Only run on trusted events (push to default branch or manual dispatch) to prevent
    # untrusted PR code from executing on the self-hosted runner.
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    needs: arduino-cli_compile_all
    runs-on: self-hosted

check_clang and arduino-cli_compile_all are unaffected and continue to run for all PRs on GitHub-hosted runners.