ci: build dev as well as main

Work now lands on dev and CI must be green there; main only moves at
release time, to the tagged commit, so a push to main is the release
validation run rather than day-to-day feedback.

leak-guard already runs on every branch (on: [push, pull_request]) and
release.yml stays tag-triggered, so neither needed a change.

.github/workflows/ci.yml

@@ -2,7 +2,10 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `dev` is where work lands and where CI must be green. `main` only ever
+    # moves at release time, to the tagged commit, so a push to it is the
+    # release validation run rather than day-to-day feedback.
+    branches: [main, dev]
   pull_request:
 
 jobs: