ci: establish dev-to-main branch flow

[WaylandYang]

Summary

• run Rust/Python and TypeScript CI for pushes and pull requests targeting both dev and main
• add a base-controlled PR policy check so future main pull requests must originate from this repository's dev branch
• document dev as the daily integration/default PR branch and main as the stable release branch

Bootstrap sequence

This one PR targets main to install the policy workflow on the protected base branch. After it merges, maintainers will fast-forward dev to the merge commit, switch the repository default branch to dev, protect dev with the required rust check, and require main-source on main.

Validation

• actionlint passes for all workflows
• positive policy case accepts deeplethe/forkd:dev
• negative policy case rejects a fork branch named dev
• git diff --check