ci: run conformance tests on push to main

[wangyb-A]

Summary

Adds a push trigger to the Conformance Tests workflow so the full-integration conformance run also executes after commits land on main, not only on pull requests.

Change

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    paths: ...

• New: conformance runs on every push to main (post-merge coverage).
• Unchanged: the existing pull_request path filters (sdk/**, pom.xml, conformance-tests/**, the workflow file) still gate PR runs exactly as before. The push trigger intentionally has no path filter so any commit landing on main gets a conformance run.

Validation

YAML parses cleanly (python3 -c 'yaml.safe_load(...)' -> OK).

[github-actions]

Codex AI review

No actionable findings. Residual risk is limited to the GitHub trigger and credential flow being exercised only after the first push to main.

Reviewed commit 822f649986fc999305ad75e46aba47645e9d9691. Workflow run

[github-actions]

Claude AI review

No actionable findings.

This PR adds a push: trigger (branches: [main]) to .github/workflows/conformance-tests.yml so the conformance suite also runs post-merge. The change is correct:

• Concurrency/stack safety is preserved. Suites deploy to fixed, shared stack names (conformance-java-${SUITE_SLUG}) with no per-run disambiguation, and the workflow uses a single fixed concurrency group (group: conformance-tests, cancel-in-progress: false). Because push and pull_request runs share that same group, they serialize against each other, so the added trigger cannot cause concurrent CloudFormation updates on the shared stacks.
• No PR-only context is used. The workflow body references no github.event.pull_request.* fields, so every step runs correctly under a push event.
• YAML is valid and correctly nested under on:.
• No application/SDK code changes, so no unit/integration/replay tests are needed for this trigger-only change.

Residual (non-blocking) considerations, not defects:

• The push trigger intentionally has no paths: filter, which the PR calls out as deliberate. Unlike the sibling e2e-tests.yml (which path-filters its push trigger), any commit to main — including docs-only or unrelated changes — will now launch a full multi-suite SAM deploy/invoke/validate run, incurring AWS cost and CI time. This is a documented tradeoff for full post-merge coverage, not a bug.
• Because push and PR runs now share the conformance-tests concurrency group, long post-merge push runs can queue ahead of PR runs, slightly delaying PR feedback. This is inherent to the shared-stack serialization design and is expected.

Reviewed commit 822f649986fc999305ad75e46aba47645e9d9691. Workflow run