ci: enforce merge source for PRs targeting main

[MaxMB15]

Summary

• Adds a check-merge-source CI job that fails PRs to main from unauthorized branches
• Only dev, chore-bump-v*, chore/release-*, and chore/sync-main-* branches are allowed

After merging, make check-merge-source a required status check in branch protection for main to fully enforce.

Test plan

• Open a test PR from a random branch to main — should fail check-merge-source
• Verify PRs from dev to main still pass

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds CI enforcement to restrict which source branches are allowed to open PRs targeting main, so branch protection can require this check before merge.

Changes:

• Introduces a check-merge-source job gated to PRs where the base branch is main.
• Fails the workflow if the PR source branch name is not in an allowlist (dev, chore-bump-v*, chore/release-*, chore/sync-main-*).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This branch-name-only check can be bypassed by PRs from forks: a fork can open a PR with head_ref set to dev (or another allowed pattern) and this job will pass. If the intent is to restrict merges to branches within this repository, also validate github.event.pull_request.head.repo.full_name == github.repository (or !github.event.pull_request.head.repo.fork) and fail otherwise, or incorporate the owner in the allowlist check.

Suggested change

	if [[ "$HEAD" == "dev" || "$HEAD" == chore-bump-v* || "$HEAD" == chore/release-* || "$HEAD" == chore/sync-main-* ]]; then
	echo "OK: '$HEAD' is allowed to merge into main."
	HEAD_REPO="${{ github.event.pull_request.head.repo.full_name }}"
	REPO="${{ github.repository }}"
	if [[ "$HEAD_REPO" != "$REPO" ]]; then
	echo "::error::Branch '$HEAD' is from fork repository '$HEAD_REPO' and is not allowed to merge into main. Only branches from '$REPO' may target main."
	exit 1
	fi
	if [[ "$HEAD" == "dev" || "$HEAD" == chore-bump-v* || "$HEAD" == chore/release-* || "$HEAD" == chore/sync-main-* ]]; then
	echo "OK: '$HEAD' from '$HEAD_REPO' is allowed to merge into main."