fix(release): refuse to tag when main has not been pushed

Pushing the tag drags the commit objects to GitHub, so the release page
looks correct while the main branch still points at older code - exactly
what happened on the 2.1.0 release, where origin/main stayed on the
previous merge. The script now fetches origin/main and refuses unless the
local HEAD matches it, naming the push command.

Also spells out what to do when VERSION still carries a -dev suffix,
since the format check alone did not say which way to resolve it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/release.sh

@@ -24,6 +24,12 @@ TAG="v${VERSION}"
 
 if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
     error "VERSION must be MAJOR.MINOR.PATCH, got '${VERSION}'"
+    case "$VERSION" in
+        *-dev|*-dev*)
+            error "This is still a development version. Drop the '-dev' suffix"
+            error "on dev, title the whatsnew section, then merge and release."
+            ;;
+    esac
     exit 1
 fi
 
@@ -38,6 +44,18 @@ if [ -n "$(git status --porcelain)" ]; then
     exit 1
 fi
 
+# The tag alone would drag the commit objects to GitHub, leaving the main
+# branch pointing at older code while a release claims otherwise
+info "Checking that main is pushed..."
+git fetch origin main --quiet
+LOCAL_HEAD=$(git rev-parse HEAD)
+REMOTE_HEAD=$(git rev-parse origin/main 2>/dev/null || echo "")
+if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then
+    error "Local main ($(git rev-parse --short HEAD)) does not match origin/main (${REMOTE_HEAD:0:7})"
+    error "Push it first:  git push origin main"
+    exit 1
+fi
+
 if git rev-parse "$TAG" >/dev/null 2>&1; then
     error "Tag ${TAG} already exists - bump VERSION before releasing"
     exit 1