publish_website: only publish from main, verify-only on release candidates (#24907)

The Publish Website workflow is triggered by `release: [published,
unpublished]` events. Release candidate releases (tags like
`iree-3.6.0rc20250910`) go through the same path: the candidate release
workflows create a draft prerelease, Build Release Packages fills it,
and Validate and Publish Release publishes it -- which fires the
`published` event and made Publish Website deploy the site from the RC,
overwriting whatever main had last published (losing a blogpost
recently).

Keep running the site build steps as verification, but skip the gh-pages
deployment when the run was triggered by a release candidate release.
Deployment still happens for main pushes, schedules, manual dispatches,
and stable releases.

Fixes #24764

Assisted-by: Claude Code / glm-5.3-flash

Signed-off-by: linsen <251731047+linsen458-spec@users.noreply.github.com>
Co-authored-by: linsen <251731047+linsen458-spec@users.noreply.github.com>