Run PR review bot on PRs targeting main

[TaprootFreak]

Summary

• Add explicit branches: [main, develop] filter to pr-review-bot.yml
• The review bot (security audit, ESLint, TypeScript check, commit verification) was not running on release PRs (develop → main), e.g. Release: develop -> main #1054
• This ensures the security audit also catches vulnerabilities before production releases

Test plan

• Verify review bot runs on next release PR (develop → main)