Run the aarch64 Windows build/test cycle only on pushes to main so PRs
wait
for a single Windows platform (x86_64). Main keeps the same native
aarch64
coverage as before.
GitHub evaluates job-level `if` before the matrix strategy is applied,
so
the aarch64 target is split into its own `windows-arm` job instead of
being
filtered inside the existing matrix. The job keeps the historical check
name.