catch up with dev

.github/workflows/ci.yml

@@ -1,14 +1,14 @@
 name: CI
 
-# Runs on PRs targeting dev/main (the pre-merge gate) and on direct
-# pushes to dev/main (this repo's actual workflow so far has been
-# committing straight to dev - this re-runs the same checks as a
-# post-merge confirmation so nothing slips through either path).
+# Runs on PRs targeting main (the pre-merge gate for dev->main catch-up
+# PRs) and on direct pushes to main (post-merge confirmation). dev itself
+# is pushed to directly and frequently, so it's intentionally excluded -
+# see cicd-setup memory for why CI was disabled in the first place.
 on:
   pull_request:
-    branches: [dev, main]
+    branches: [main]
   push:
-    branches: [dev, main]
+    branches: [main]
 
 env:
   DOTNET_NOLOGO: true

.github/workflows/codeql.yml

@@ -1,14 +1,15 @@
 name: CodeQL
 
-# Security scanning (SAST). Runs on PRs/pushes to dev/main plus a weekly
+# Security scanning (SAST). Runs on PRs/pushes to main plus a weekly
 # schedule so newly-disclosed vulnerability patterns get caught even on
 # code nobody's touched recently - this is GitHub's own recommended
-# default cadence for CodeQL.
+# default cadence for CodeQL. dev is excluded since it's pushed to
+# directly and frequently - see cicd-setup memory.
 on:
   pull_request:
-    branches: [dev, main]
+    branches: [main]
   push:
-    branches: [dev, main]
+    branches: [main]
   schedule:
     - cron: "0 6 * * 1"