ci: run the tests, and keep main reachable only by release or hotfix

[rousso]

Two guards. The repository had neither.

The tests

There was a test suite and nothing running it, so a pull request could merge with it failing. update-exchange-rates.yml was the only workflow.

Adds a tests workflow — npm ci then npm test, Node 20, matching the exchange-rates job — on every pull request and on pushes to main and develop. npm ci rather than npm install, so a run tests the versions package-lock.json pins rather than whatever resolves on the day.

The source of a merge into main

main is what production serves, and it should be reached one of two ways: a release cut from develop, or a hotfix. Its history says otherwise — FixEditorForStandardForm, ClickableLinks and chore/dependabot-transitive-bumps all merged straight in.

GitHub has no setting for "only these branches may open a pull request into this one", so a check stands in for it: guard main fails when the source branch is neither release/* nor hotfix/*, with an error saying where the work belongs instead.

Nothing automated is affected — update-exchange-rates.yml pushes to data/exchange-rates, not to main.

Neither workflow is path-filtered

Deliberately. A required check that only runs sometimes cannot be satisfied the rest of the time: nothing reports, and the pull request waits for a status that never arrives.

After this merges

node --test and source branch become required checks on the branches they apply to. Until then they report and nothing depends on them.

[rousso]

Superseded by #128, which back-merges the same workflows from main with the tightened guard.