ci: add main dev-gate required check

[oscharko]

Summary

Add the GitHub Actions job that emits the Only dev may merge to main status required by main branch protection.

Refs #116.

Scope

• In scope: CI-only gate job for protected dev branch checks.
• Out of scope: product code, release package contents, or documentation changes.

Product Impact

• UI or user workflow
• CLI or developer workflow
• Core generation engine
• Evidence, audit, or compliance artifact
• Security or supply chain
• Packaging, release, or npm publication
• Documentation or repository hygiene
• No user-facing behavior change

Verification

Required:

• Required GitHub checks pass before merge.
• Local verification commands or rationale are listed below.

Local verification:

ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); puts "yaml ok"'

Select only what applies:

• UI behavior manually verified or covered by tests.
• CLI behavior verified with command output or tests.
• Core logic covered by unit, integration, property, or fixture tests.
• Security-sensitive change reviewed for trust boundaries, secrets, external calls, and generated artifacts.
• Supply-chain or package-surface change verified with package, license, lockfile, SBOM, or npm dry-run checks.
• Documentation or Markdown change verified by the repository link check or a targeted local equivalent.
• Release-impacting change verified with pnpm run release:check or an explicit rationale.
• Not applicable items are explained below.

Not applicable rationale:

• No runtime/package code changed; this only adds the required GitHub Actions status gate for main promotion.
• This repository uses npm scripts rather than pnpm run release:check; the relevant verification is CI syntax plus protected-branch checks.

Review And Closure

• The PR implements only the linked issue scope.
• Actionable review findings are fixed or explicitly dispositioned.
• Unresolved review threads are resolved before merge.
• Checks are repeated after the latest pushed fix.
• Issue acceptance criteria and closure evidence are updated only where evidence exists.
• Use Resolves #<issue_number> only when this PR should close the issue.

Risk Notes

This is a branch-protection plumbing change. If the job name drifts from the required status context, main promotion remains blocked; the job name therefore intentionally matches the required check exactly.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.