hotfix/2.3.1 — put the test and guard workflows on main

[rousso]

CI only. No change to the application.

Why this is a hotfix rather than waiting for 2.4.0

A hotfix branch is cut from main. When its pull request is opened, GitHub builds the merge commit from that branch and main — so if the workflows live only on develop, neither side has them, neither check runs, and with the checks required the hotfix cannot merge. To get out you would have to switch protection off, at exactly the moment you are shipping an urgent fix.

Putting them on main now means every branch cut from it carries them.

Why the version moves

So that every commit on main belongs to a release that can be pointed at. Without a bump, two different main commits would both call themselves 2.3.0 and the version would stop identifying what is deployed.

There are no release notes to write: this changes nothing a user can observe.

What lands

• tests — npm ci then npm test, Node 20, on every pull request and on pushes to main and develop.
• guard main — a pull request into main must come from release/x.y.z or hotfix/x.y.z, the latter with a patch of 1 or more. Anything else fails with a message saying to go through develop.

Neither is path-filtered: a required check that only runs sometimes cannot be satisfied the rest of the time.

Checked

• main passes its own suite: 290 tests.
• The guard was proven on both paths before being tightened — it failed a pull request from test/guard-should-block and passed one from release/guard-test, both closed unmerged.
• The tightened rules were exercised over the shapes that matter: release/2.4.0 and hotfix/2.3.1 pass; hotfix/2.3.0, release/2.4, release/2.4.0-rc1, develop and a plain feature branch all fail.
• This pull request comes from hotfix/2.3.1, so it should pass its own guard.