ci: reject feature/fix branches that target main directly

A feature/fix branch merges into a release or maintenance branch; only
release/* merges into main. Opening a second PR at main from the same
branch is a duplicate, and it also breaks the changelog fragment, which is
numbered for exactly one PR.

This pattern already cost a wasted PR in six repositories (a ->release PR
merged alongside a ->main PR that was then closed), and the fragment
numbering check only exposed it indirectly, by failing the leftover PR.

hotfix/* -> main stays allowed; the version control policy calls for
hotfixes to be merged back to main and the active release branch.

Author: vistart

.github/workflows/changelog-check.yml

@@ -3,6 +3,7 @@
 # Enforces the rhosocial changelog fragment rules.
 #
 #   feature/* or fix/*  ->  release/* | maint/*|  main
+#     - a feature/fix branch must not target main directly
 #     - the PR must add at least one changelog.d/<number>.<type>.md fragment
 #     - every added fragment's <number> must equal the PR number
 #     - fragments already present in changelog.d/ from previously merged
@@ -167,6 +168,28 @@ jobs:
             exit 0
           fi
 
+          # A feature/fix branch never merges straight into main; it targets a
+          # release or maintenance branch. Opening a second PR at main from the
+          # same branch is a duplicate, and it also invalidates the fragment
+          # numbering, which is bound to a single PR number.
+          if [[ ("$HEAD_REF" == feature/* || "$HEAD_REF" == fix/* || "$HEAD_REF" == bugfix/* \
+                || "$HEAD_REF" == test/* || "$HEAD_REF" == docs/* || "$HEAD_REF" == chore/*) \
+                && "$BASE_REF" == "main" ]]; then
+            echo "::error::'$HEAD_REF' must not target \`main\` directly."
+            echo ""
+            echo "Per the rhosocial merge rules:"
+            echo "  feature/* fix/* bugfix/* test/* docs/* chore/*  ->  release/* | maint/*"
+            echo "  release/*                                            ->  main"
+            echo ""
+            echo "Retarget this PR at the active release branch, or close it if"
+            echo "another PR from '$HEAD_REF' already targets the release branch."
+            echo "The changelog fragment is numbered for one PR only, so a duplicate"
+            echo "PR at main would also fail the fragment numbering check."
+            echo ""
+            git branch -r --list "origin/release/*" | sed 's#.*origin/##' | sed 's/^/    /'
+            exit 1
+          fi
+
           git fetch origin "$BASE_REF" --quiet
 
           # Fragments ADDED by this PR. Fragments that were already in