ci: prepare develop as default branch

[smiggleworth]

Change

• Run CI for pushes and pull requests to both develop and main.
• Reject package publication from any branch other than main.

This prepares develop to become the default development branch while keeping main as the release branch. After merge, develop will be created from the updated main head and protected.

Validation

• actionlint on the changed workflows
• git diff --check

No package version, tag, or publication is part of this change.