* ci(release): gate promote-main on explicit main checks
Add an always-on ci-main workflow that produces a stable check name, and validate that check via check runs (not branch protection APIs). Wire promote-main-to-next to require ci-main / ci-ok and document the required check in the release SOP.
* ci(release): accept ci-ok or UI-style name in main promote gate
GitHub check run names for normal workflows are often the job name only;
keep optional match for the UI-style workflow/job label. Drop unused
statuses:read permission.
Made-with: Cursor
cucadmuh