Depth testing occurs after the pixel shader. See this question.
Also, its clear that the pixel shader runs more than once per pixel. Consider alpha blending: the opaque pixels must be rendered first, and then transparent pixels are blended with the already rendered opaque pixels. This could never happen if the pixel shader was only entered once per pixel.
"Once per primitive" is not the correct terminology. A single primitive will most likey cover multiple pixels, so a single primitive will cause the pixel shader to be run for each pixel that the primitive covers.
To prevent the pixel shader from being run on primitives that are obscured by other objects, you must implement some form of occlusion culling. Alternatively, some drivers may do this for you to a certain extent. See this link and comment below.