Cut releases from main only, enforced where it can be

main is protected on the remote and takes no direct pushes, so a release
arrives as a pull request from dev. Document that flow.

`make image` refuses to run outside main. That check has to live locally:
the tag and the image are made before anything reaches the remote, so branch
protection cannot catch a release built from the wrong branch.

A pre-commit hook was tried and dropped. It needed installing per clone, so
it enforced nothing that the remote was not already enforcing, while implying
it did.

Makefile

@@ -81,6 +81,14 @@ fix: ## Format Go and templ sources, tidy go.mod
 
 image: ## Build and tag an image as vYYYYMMDD-N. Creates a git tag.
 	@test -n "$(FOODSTER_REPO)" || { echo "set FOODSTER_REPO in .env"; exit 1; }
+	@# A release tag must point into main, or the tag records a commit that
+	@# was never released.
+	@branch=$$(git symbolic-ref --short HEAD); \
+	if [ "$$branch" != "main" ]; then \
+		echo "releases are cut from main, not $$branch:"; \
+		echo "  git switch main && git merge --ff-only dev"; \
+		exit 1; \
+	fi
 	@day=$$(date +%Y%m%d); \
 	tag="v$$day-$$(( $$(git tag -l "v$$day-*" | wc -l) + 1 ))"; \
 	echo "==> $$tag"; \