ci(release): gate release-pr to the main ref (RIG-3813)

[rigel-mintaka]

Closes RIG-3813.

release.yml accepts workflow_dispatch from any ref, and release-pr was the one sensitive job
in the file with no if: guard. It holds contents: write + pull-requests: write, mints the
installation-scoped release-please App token, and is the sole vX.Y.Z tag minter. Because
release-please defaults target-branch to the repository default branch, the dispatched ref did not
scope what the job acted on: a dispatch from a feature branch would cut a real release from main.

What changed

Two lines of real change in .github/workflows/release.yml:

1. release-pr gets if: github.ref == 'refs/heads/main', the same guard publish-image,
   release-assets-macos, release-assets, release-image and publish-runner-image already
   carry.
2. The release-please step pins target-branch: main rather than relying on the action's
   default-branch default, so the release branch is stated rather than inferred.

Why it matters now

The same workflow holds agent-image-arm64-spike, which is if: github.event_name == 'workflow_dispatch' by design. Because release-pr was ungated, any dispatch of this workflow
started release-pr alongside the spike, which is what made that spike job unsafe to dispatch from
a feature branch. With this guard, a non-main dispatch runs the spike and skips release-pr.

Verification

• Every job's if: enumerated by parsing job line boundaries: all seven jobs now carry a guard, and
  release-pr's new one appears exactly once, inside its own block.
• target-branch confirmed to be a real input of the action at its pinned SHA
  (5c625bfb5d1ff62eadeeb3772007f7f66fdcf071), by decoding that ref's action.yml.
• actionlint from the dev shell: 6 findings (3 shellcheck, 3 syntax-check), message sets identical
  between base main and this tree after stripping line and column. The syntax-check findings are
  the unknown queue: max concurrency key at three concurrency blocks and pre-date this change.
  Zero new findings.
• No behaviour change on the push to main path, which is the only path that previously reached
  this job legitimately.

Open Questions

None load-bearing. One judgment call recorded for the reviewer, stated precisely: target-branch: main is not what closes the dispatch hazard. The ref guard does, and with the guard present no
non-main ref reaches this job at all, so the pin contributes nothing to that attack path.

It is kept because it closes a different, real hazard. Without it, release-please reads the
repository's mutable default_branch over the API on every run, so a branch rename silently
repoints the release lane. It also fixes the standing Release PR's head branch name, which
release-please derives as release-please--branches--<target-branch>: main is the value that
preserves the identity of the existing Release PR, so any other pin would orphan it and open a
second one.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[linear-code]

RIG-3813

[github-actions]

Compass engineering docs preview: https://compass-native-rig-3813-rele.compass-eng-docs.pages.dev

Deployed from compass-native/rig-3813-release-pr-ref-guard at 9918238.