release: refuse to run from any ref other than main

The job pushes HEAD to main and tags it, so a dispatch from another branch
would have fast-forwarded main to that branch. A first step now fails the
run, before checkout, unless github.ref is refs/heads/main.

Closes #170

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpkeXRUqm7oDedPDk3QWtK

Author: TMHSDigital

.github/workflows/release.yml

@@ -22,6 +22,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # The job pushes HEAD to main and tags it, so a dispatch from any other
+      # ref (a thumbs/<month> branch, say) would ship that ref. Stop first.
+      - name: Refuse a ref other than main
+        if: github.ref != 'refs/heads/main'
+        env:
+          REF: ${{ github.ref }}
+        run: |
+          echo "::error::Dataset release runs from main only; this run is on $REF."
+          exit 1
+
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: