ci(release): guard release workflow against non-main dispatch

Add if: github.ref == 'refs/heads/main' to both jobs in release.yml so
that an accidental workflow_dispatch from develop or a feature branch
exits without bumping the version, tagging, or publishing.

The guard goes on each job (not at workflow level) because workflow-level
if: is not valid for workflow_dispatch.

Trigger remains workflow_dispatch:. The review document suggested
migrating to tag-based push triggers, but this workflow creates the tag
itself, so reacting to its own tag would be circular. Dispatch with a
hard branch guard is the right pattern here.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MarTrepodi

.github/workflows/release.yml

@@ -7,6 +7,7 @@ jobs:
   release:
     name: Semantic Release
     runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
 
     concurrency:
       group: ${{ github.workflow }}-release-${{ github.ref_name }}
@@ -70,6 +71,7 @@ jobs:
   # Publish the package to PyPI
   pypi-publish:
     runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
     needs:
       - release
     permissions: