fix(ci): disarm the Inbox Steward notification amplifier

check_suite:[completed] and workflow_run:[completed] made this workflow fire
once per CI completion on every watched workflow -- a multiplier on every unit
of estate CI activity, and the mechanism behind the notification burst of
2026-07-20/21 (measured: 3,041 CheckSuite notifications inside a ~19-hour
window, and none since).

The workflow is currently disabled_manually, which is why the burst stopped.
That makes the risk latent rather than resolved: these triggers plus
contents:write / pull-requests:write mean re-enabling it would restart the
multiplier. Removing them so re-enabling is safe.

pull_request, pull_request_review and workflow_dispatch are retained -- the
monitoring path the workflow was neutered down to in 2026-06 is untouched.

Verified: YAML parses and the trigger map is now exactly
pull_request, pull_request_review, workflow_dispatch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/inbox-steward.yml

@@ -21,15 +21,12 @@ on:
     types: [opened, synchronize, ready_for_review, converted_to_draft, review_requested]
   pull_request_review:
     types: [submitted, dismissed]
-  check_suite:
-    types: [completed]
-  workflow_run:
-    workflows: 
-      - Dogfood Gate
-      - Scorecard Enforcer
-      - Hypatia Security Scan
-      - Static Analysis Gate
-    types: [completed]
+  # AMPLIFIER REMOVED 2026-07-29. check_suite:[completed] and
+  # workflow_run:[completed] made this fire once per CI completion on every
+  # watched workflow -- a multiplier on every unit of estate CI activity, and
+  # the mechanism behind the 3,041-notification burst of 2026-07-20/21.
+  # The workflow is currently disabled_manually; these triggers are removed so
+  # that RE-ENABLING it is safe. PR/review events and workflow_dispatch remain.
   # Manual trigger
   workflow_dispatch:
     inputs: