Implement clean workflow: tests on every PR, always build, controlled versioned publish and branch strategy

[marcvolkert]

Goal

Enhance GitHub Actions and repository settings to enforce a clean workflow with branch-specific rules for building, testing, and releasing.

Requirements & Proposed Workflow

• Branches to support: feature/*, copilot/*, dev, main.
• Always run tests and builds for all pull requests targeting dev or main.
• Block merging if checks do not pass.
• Only publish packages or releases if a version tag is present after setting a version tag on dev or merging into main.
• If a version tag is pushed on dev, build and tag as pre-release (e.g., beta/rc).
• If a version tag is merged into main, build and publish a full release (e.g., NPM/public release).

What needs to be changed:

• Update or create GitHub Action workflows to:
  • Always run CI (build/test) for every PR against dev and main.
  • Only trigger publishing jobs if a version tag is present.
  • Implement publishing logic:
    • On dev with a version tag: publish as pre-release.
    • On main with a version tag: publish as release.
• Adjust repository settings:
  • Set branch protections for main and dev (as above).
  • Validate branch naming if possible (feature/*, copilot/*, dev, main).

Acceptance Criteria

• PRs to dev/main cannot be merged without passing tests/builds.
• Builds always occur, but publishing only happens with version tags.
• Non-main version tags trigger pre-releases; only tags on main publish releases.
• Branch protections and naming conventions enforced where possible.