Document the release branch policy

main carries released versions only, so its history is the deployment
history and every release tag points into it. Development happens on dev
and merges into main when a release is cut.

README.md

@@ -47,6 +47,19 @@ One static Go binary. No Node.js, no bundler, no separate database server.
 | Auth | HTTP Basic, one shared household password |
 | Runtime image | `FROM scratch` |
 
+## Branches
+
+`main` holds released versions only. Every release tag points at a commit on
+`main`, so its history is the deployment history.
+
+All development happens on `dev`. Merge into `main` when cutting a release,
+then build and push the image from there.
+
+```sh
+git switch dev          # where the work happens
+git switch main && git merge dev && make release
+```
+
 ## Quick start
 
 ```sh