dev is a protected branch requiring PRs. The previous direct push caused the lockfile update CI job to fail with 'protected branch hook declined'. When the triggering branch is dev, the workflow now creates a side branch and opens a PR; all other branches continue to push directly.