chore: point renovate.json at next, add main-branch guard

[ss-o]

Problem

Same root cause found and fixed in z-shell/zsh-eza this session: renovate.json has no baseBranches override, so Renovate defaults to the repo's default branch (main), bypassing next. dependabot.yml was already fixed for this in #172, but Renovate wasn't. src's PR history includes many renovate/*-headed PRs merged straight to main (#171, #150-#156, etc.), confirming this is a live, exercised gap, not theoretical.

next was also found 1 commit behind main (PR #176, merged directly from a non-next/hotfix-* branch by the Copilot coding agent) -- already fast-forwarded to resolve.

There's also no equivalent of zsh-eza's main-branch-guard.yml required-status-check workflow to prevent this class of issue going forward.

Fix

• renovate.json: add "baseBranches": ["next"].
• Add .github/workflows/main-branch-guard.yml: required-status-check workflow that fails a PR targeting main unless its head branch is next or matches hotfix-*, per ADR-0008's next -> main branching model.
• Wire the check into main's ruleset as a required status check once it has run at least once on a real PR.

[ss-o]

Resolved via #178 (merged into next) and #179 (squash-promoted to main, commit 5e301f2). main's ruleset now requires the Guard main branch source check.