Restrict TOC generator to master branch and README.md changes

The overly broad 'on: push' trigger ran the TOC generator with write
permissions on every push to every branch. Scope it to master only and
only when README.md changes to reduce attack surface and unnecessary
workflow runs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>