fix(ci): skip cert-bot publish loop and ignore conformance-only pushes

- Gate mint/publish on the real GitHub App actor (intentproof-cert-bot[bot]),
  not github-actions[bot], so follow-up commits from the app do not re-run publish.
- On push to main, ignore paths that only update repo-root conformance JSON so
  main does not churn after artifact commits (fewer stale PR bases).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -3,6 +3,11 @@ name: CI
 on:
   push:
     branches: [main, master]
+    # Cert-bot follow-up commits only touch these files; skip full CI so `main` does not
+    # churn behind open PRs (and avoid re-entering publish when actor guards drift).
+    paths-ignore:
+      - "conformance-certificate.json"
+      - "conformance-report.json"
   pull_request:
 
 concurrency: