release.yml: guard that releases only cut from main

[jbeda]

Problem

release.yml triggers on v* tags with no branch constraint, so a v* tag
cut from any branch — not just main — would fire a release. A fat-fingered
tag off a feature branch could publish an unintended release.

GitHub's on: push: tags: can't be branch-filtered in the trigger itself, so
this needs a runtime guard, not a trigger change.

Proposed fix

Add a first job/step that fails the workflow if the tagged commit isn't on
main, e.g.:

- name: Ensure tag is on main
  run: |
    git fetch origin main --depth=1
    if ! git branch -r --contains "$GITHUB_SHA" | grep -q 'origin/main'; then
      echo "::error::release tags must be cut from main"
      exit 1
    fi

Context / priority

Only maintainers with push access can create tags, so this guards against an
accidental fat-finger rather than a malicious actor. Not urgent, but worth
doing before releases become routine — a release accidentally cut from a
feature branch now ships to the public, not just internal consumers.