fix(ci): guard publish-latest against non-main dispatch

Reject workflow_dispatch runs from non-main refs to prevent
publishing unintended code or fast-forwarding main unexpectedly.

.github/workflows/publish-latest.yaml

@@ -22,6 +22,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout