- remove meaningless badge
- also lint/test pushes (not just PRs)
- allow running the job explicitly on-demand ("workflow dispatch")
- cancel in-progress runs on PR update / push to the same branch
- explicitly limit GitHub token permissions

Signed-off-by: Tianon Gravi <admwiggin@gmail.com>