ci: drop develop-FF gate from release dispatches; require main

[rado0x54]

Summary

• Remove the `develop is ancestor of main` precondition from both `agent-release` and `release` workflow_dispatch validations. Releases cut from `main` HEAD; what's on `develop` is irrelevant (agent binaries build off main; server release promotes `:stable`, which is only built on main pushes).
• Add a hard guard at the top of each validate step: dispatching from anything other than `refs/heads/main` fails fast with a clear error. (GitHub doesn't let us hide the branch picker in the dispatch UI, so this is the next best thing.)

Test plan

• Trigger Agent Release from `main` — validate step passes, build/release proceed.
• Trigger Agent Release from `develop` — fails at validate with the new ref guard.
• (When next cutting a server release) trigger Release from `main` — validate passes without needing develop to equal main.