Enforce PR promotion path: * -> dev and dev -> main only

[Copilot]

This change enforces a strict branch promotion flow in pull requests: any feature branch can target dev, and only dev can target main. PRs outside this path are blocked at workflow level.

• Policy enforcement workflow

  • Added .github/workflows/pr-branch-policy.yml on pull_request events.
  • Validates base.ref and head.ref combinations:
    • allow: * -> dev
    • allow: dev -> main
    • deny: all other source/target pairs

• Security hardening

  • Added explicit workflow token restriction with permissions: {} since the job only reads PR metadata.

permissions: {}

if [ "$BASE_REF" = "dev" ]; then
  exit 0
fi

if [ "$BASE_REF" = "main" ] && [ "$HEAD_REF" = "dev" ]; then
  exit 0
fi

exit 1