chore(ci): drop publish triggers that cannot publish - #56078

Stacked on #56075 (pack-libraries), the top of the publish speed-up stack (bottom: #55987).

Summary

publish.yml now runs on pushes to dev and beta only. It drops the push triggers for ci, fix/npm-native-binary-install and snapshot-*, which can no longer publish anything. This removes 3 lines. No job or step condition changes: none of them names these branches, and workflow_dispatch still works on any branch.

Why each trigger was dead

• snapshot-*: before this stack, these runs failed at "Build legacy CLI", which builds packages/opencode/script/build.ts. packages/opencode no longer exists on dev. The last run (snapshot-repository, 29934522977, July 22) failed there.
• ci: same "Build legacy CLI" path. It last ran in January 2026.
• fix/npm-native-binary-install: a branch trigger for testing Fix npm CLI binary installation #27801, which merged on 2026-05-15. Its one run (25944766634) failed at Azure login in sign-cli-windows and the Windows build-electron legs.

After #56070 (cli-target-jobs), any of these pushes would run all 12 build-cli legs plus Developer ID signing on macOS. It would then stop at publish's "Check CLI packages" guard, because sign-cli-windows only runs on dev. Every push would cost runner time and produce nothing.

Dependencies checked

• Workflows, actions, scripts, docs: nothing else names these branches. publish.yml is the only workflow with a branch filter for them.
• packages/script channel logic: nothing keyed on them. The fallback that turns a branch name into a channel is generic. It still covers local runs and dispatches, and dev sets OPENCODE_CHANNEL=dev itself.
• services/update: channelsForRef still maps refs/heads/ci, refs/heads/fix/npm-native-binary-install and refs/heads/snapshot-* to update channels for publish OIDC tokens. Those entries are now unused, but removing them changes a deployed service, so it is left for a separate PR.

Safety rule

The stack's handover rule "never push branches named ci, dev, beta, fix/npm-native-binary-install or snapshot-*" shrinks to dev and beta. GitHub reads on.push from the workflow file in the pushed commit, so the rule only shrinks for commits that contain this change. Pushing an old snapshot-* or ci tip, or one based on dev before this merges, still triggers the old workflow.

Verification

• actionlint 1.7.7 passes with the repository's self-hosted runner labels. shellcheck was not installed locally, so it did not run.
• The diff only removes the three trigger lines. The dev and beta paths are byte for byte unchanged.