main is protected and only receives merges from dev; pushing directly to it from CI is blocked by branch protection rules.