workflow/deploy: don't process all branches

In the deploy workflow, using a push branch config of ** results in it
trying to gpg init for branches created by dependabot or anyone/anything
else. This is not what we want - we want those covered by pull request
events.

Change the config to only handle pushes to main (and continue to handle
all tags and all PRs).

Signed-off-by: Andy Goldstein <[email protected]>

.github/workflows/deploy.yml

@@ -3,7 +3,7 @@ name: Deploy
 on:
   push:
     branches:
-      - '**'
+      - 'main'
     tags:
       - 'v*'
   pull_request:
@@ -24,7 +24,7 @@ jobs:
       run: .ci/gpg/create-keyring.sh
       env:
         GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
-        
+
     - name: Install Go
       uses: actions/setup-go@v4
       with: