ci: run the gates on every push and pull request, not only at release

The gates already ran before publishing, but that is late: a broken commit sat on
main until someone tagged a release. This catches it at the commit.

Smoke tests stay deselected. They call live upstream sources, and an outage at a
government portal is not a reason to redden our CI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>