Fix: deploy workflow could publish a non-main branch to production

[Aditya30ag]

Fixes #96

Problem

The deploy job's if condition let a manual workflow_dispatch run bypass the main-branch check entirely:

- github.event_name != 'pull_request' && (
- github.ref_name == 'main' ||
- github.event_name == 'workflow_dispatch'
- )
+ github.event_name != 'pull_request' &&
+ github.ref_name == 'main'

Because of the original ||, dispatching the workflow on any branch satisfied the condition and this job deploys with contents: write + force_orphan: true (which wipes gh-pages history), so an accidental manual run from the wrong branch would overwrite the live site with unreviewed content and destroy the previous deployment history.

Change

Require ref_name == 'main' unconditionally, for both push and workflow_dispatch triggers. push behavior is unchanged. Manual redeploys via workflow_dispatch still work exactly as before, as long as they're triggered on main they just can no longer target other branches.

Type of change

• Bug fix (workflow/CI, non-breaking for normal use)