ci: gate macOS build outside pull requests

[saagpatel]

What

• Skip the expensive macOS Tauri build on pull_request events.
• Keep the macOS build available on default-branch pushes and manual workflow dispatch.

Why

• Pull requests already run the security, frontend, Rust, UI, performance, and policy gates.
• The macOS packaging build is slow enough to block small CI/security PRs while still being useful on the default branch.

How

• Add workflow_dispatch to the core health workflow.
• Gate the Build (macOS) job with github.event_name != 'pull_request'.

Testing

• Workflow YAML parse passed locally.

Performance Impact

• Reduces PR CI time and macOS runner usage; default-branch packaging coverage remains.

Risk / Notes

• Risk is limited to PR-time packaging coverage. The build still runs on default-branch pushes and can be triggered manually.