ci: run install matrix for main merge queue

[tomdps]

Summary

• keep the main-only install matrix behavior
• force the matrix job to evaluate after the check job succeeds even when the PR-source guard is skipped on merge_group events
• unblocks the main merge queue required install-matrix contexts for release PR ci(release): require npm trusted publishing #505

Verification

• git diff --check -- .github/workflows/ci.yml
• npx prettier --check .github/workflows/ci.yml
• pre-commit: typecheck
• pre-commit: validate:templates
• push hook: lint
• push hook: typecheck