P1 E9: run full CI for dev-to-main release PRs

[gnanirahulnutakki]

Parent: #27.

Problem

The CI workflow currently triggers pull-request runs only when the base branch is dev. A reviewed dev -> main release PR therefore receives CodeQL but not its own full CI/release-snapshot/two-cluster proof. Exact green dev CI is necessary but does not validate the release boundary itself.

Scope

• Extend CI triggers to both dev and main for pull requests and pushes.
• Keep the same pinned toolchain, reproducibility, vulnerability, and Kind integration gates.
• Document that a release PR must be green before merge.
• Validate with the existing local CI/release gates and prove the new dev -> main PR checks on release: v0.3.0-beta.1 #156.

Out of scope

• Changing branch protection, weakening checks, release tags, release artifacts, or unrelated CI logic.

Acceptance

• A dev -> main PR executes ci and CodeQL.
• A main merge has an exact push CI record.
• Existing feature PR behavior into dev remains unchanged.

Refs: #156, #154, #27.

[gnanirahulnutakki]

Completed in #158 and proven on both release promotions. The CI trigger now runs the complete matrix for dev and main pushes and PRs. Release PR #161 independently passed CI 29368893941 and CodeQL 29368890834; its main merge then passed exact CI 29369389761 and CodeQL 29369388611 before beta.2 was tagged. No jobs, permissions, pins, or existing dev coverage were weakened.