ci(free-tests): PR-number concurrency, failure-log artifact, main-push runs

Three red-team/adversarial findings on the new required lane:
(1) concurrency keyed on bare head_ref — two forks with the same
branch name shared one group, so a push to fork B cancelled fork A's
in-flight REQUIRED check (merge-pipeline DoS with no code fault); key
on the PR number. (2) The runner's full logs die with the runner in
os.tmpdir() — a red check named WHICH test failed but never why;
upload the shard logs as an artifact on failure. (3) PR-only trigger
meant two individually-green PRs could merge into a red main with
nothing running the suite there; add push: branches: [main].

.github/workflows/free-tests.yml

@@ -24,6 +24,10 @@ name: Free Tests
 on:
   pull_request:
     branches: [main]
+  # Also on main pushes: two individually-green PRs can merge into a red
+  # main; without this nothing runs the free suite on main until the next PR.
+  push:
+    branches: [main]
   workflow_dispatch:
 
 concurrency: