[soulbah]

main did not exist and a version tag on any commit published to the stores, so an unreviewed or unpromoted commit could reach Open VSX and the Visual Studio Marketplace.

Changes

• ci.yml (verify) runs on pull requests into dev and main and no longer on push. A pull request into main must come from this repository's dev and fast-forward main.
• promote.yml, dispatched from dev with the promotion pull request number, fast-forwards main to the exact head on which verify passed.
• release.yml refuses a tag whose commit is not on main or has no passing verify from its promotion pull request, before packaging or publishing anything.
• docs/releasing.md and AGENTS.md describe promotion and tagging the main commit.

Validation

• actionlint passes on the three workflows; Biome check passes.
• Hosted verify on this pull request.
• main will be created at the merged dev commit and protected together with dev (required verify, pull request, linear history).