Cut releases from main only, enforced where it can be

main is protected on the remote and takes no direct pushes, so a release
arrives as a pull request from dev. Document that flow.

`make image` refuses to run outside main. That check has to live locally:
the tag and the image are made before anything reaches the remote, so branch
protection cannot catch a release built from the wrong branch.

A pre-commit hook was tried and dropped. It needed installing per clone, so
it enforced nothing that the remote was not already enforcing, while implying
it did.

PRD.md

@@ -360,7 +360,10 @@ on the server and run with Docker Compose.
 
 - **Branches**: `main` carries released versions only, so its history is the
   deployment history and every release tag points into it. Development happens
-  on `dev` and merges into `main` when a release is cut.
+  on `dev`, and `main` is protected on the remote: it accepts no direct
+  pushes, so a release arrives as a pull request from `dev`. `make image`
+  additionally refuses to run outside `main` — that one has to be local,
+  because the tag and the image are made before anything reaches the remote.
 - **Versioning**: CalVer `vYYYYMMDD-N`, where `N` is the Nth build of that
   day. `make image` derives `N` by counting the day's existing git tags,
   creates the new tag, and bakes the version into the binary through