Run CI on development and document the branch workflow

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, development]
   pull_request:
 
 permissions:

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing
+
+## Branches
+
+- `main` is what has been released. It changes only through pull requests,
+  and every release is a tag on it.
+- `development` collects the work for the next release.
+- Work happens on a short-lived branch from `development`, named for what it
+  does: `feature/...`, `fix/...`, `docs/...`, `ci/...`. Open a pull request
+  into `development`, and delete the branch once it is merged.
+- A release is a pull request from `development` into `main`, followed by a
+  tag on `main`; see [docs/releasing.md](docs/releasing.md). If `main` then
+  has commits `development` lacks, merge `main` back into `development`.
+- An urgent fix branches from `main` as `hotfix/...`, merges into `main` and
+  is released as a patch, and is then merged into `development`.
+
+Both `main` and `development` are protected: a change needs a pull request
+whose `test` and `build` checks pass, and nobody, admins included, can push
+to them directly or force-push.
+
+Keep commits focused, with messages in the imperative. Rebase a branch onto
+`development` rather than merging `development` into it.
+
+## Tests
+
+See [Development](README.md#development) in the README.

docs/releasing.md

@@ -1,5 +1,15 @@
 # Releasing rypt
 
+A release is a pull request from `development` into `main` (see
+[CONTRIBUTING.md](../CONTRIBUTING.md)). Once it is merged, tag the merge
+commit on `main`:
+
+```sh
+git switch main && git pull
+git tag -a v1.0.0 -m v1.0.0
+git push origin v1.0.0
+```
+
 Pushing a tag that starts with `v` runs
 [.github/workflows/release.yml](../.github/workflows/release.yml). It runs
 `make vet test race`, builds the six binaries with GoReleaser
@@ -8,11 +18,6 @@ binaries, publishes a GitHub release with the binaries, `SHA256SUMS`, and a
 changelog of the commits since the previous tag, and then updates the
 Homebrew cask in [x6c-co/homebrew-tap](https://github.com/x6c-co/homebrew-tap).
 
-```sh
-git tag -a v1.0.0 -m v1.0.0
-git push origin v1.0.0
-```
-
 A tag with a pre-release suffix, such as `v1.1.0-rc.1`, is published as a
 pre-release and leaves the Homebrew cask alone. `rypt version` prints the tag.
 
@@ -21,7 +26,7 @@ output: `rypt-linux-amd64`, `rypt-darwin-arm64`, `rypt-windows-amd64.exe`, and
 so on.
 
 [.github/workflows/ci.yml](../.github/workflows/ci.yml) runs the same tests on
-every push to `main` and every pull request, and builds all six targets with
+every push to `main` and `development` and every pull request, and builds all six targets with
 the release configuration, unsigned.
 
 To build locally with the release configuration, unsigned, install