fix: restrict bar release workflow to main (#1612)

.github/workflows/bar-release.yml

@@ -5,7 +5,7 @@ name: Bar Release
 #
 # Scoped deliberately so it NEVER burdens other PRs or CI:
 #   - Triggers ONLY on push to `main` that changes `macos-bar/**`, or a manual
-#     run. Regular PRs, dev pushes, and non-bar changes do not start it.
+#     run from `main`. Regular PRs, dev pushes, and non-bar changes do not start it.
 #   - Runs ONLY on the dedicated self-hosted macOS runner (label `ccs-bar` on
 #     kai-minim4). The Linux CI runners never match this job, and this job never
 #     competes for them.
@@ -32,10 +32,14 @@ concurrency:
 jobs:
   release:
     name: Build and publish CCS Bar
+    if: github.ref == 'refs/heads/main'
     runs-on: [self-hosted, macos, ccs-bar]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: main
+          persist-credentials: false
 
       - name: Read bar version
         id: ver

docs/ccs-bar.md

@@ -126,10 +126,10 @@ The app ships as a single floating GitHub release asset, `CCS-Bar.app.zip` under
 
 The `Bar Release` workflow (`.github/workflows/bar-release.yml`) builds and publishes the asset automatically. It is scoped tightly so it never affects other PRs or CI:
 
-- It runs only on a push to `main` that touches `macos-bar/**`, or a manual run from the Actions tab (`workflow_dispatch`).
+- It runs only on a push to `main` that touches `macos-bar/**`, or a manual run from the Actions tab (`workflow_dispatch`) when the selected ref is `main`.
 - It runs only on the dedicated self-hosted macOS runner (label `ccs-bar`); the Linux CI runners never pick it up and it never competes for them.
 
-So bar changes reach users when they land on `main` (the stable cadence). To cut a release without a code change, or to re-publish, trigger the workflow manually.
+So bar changes reach users when they land on `main` (the stable cadence). To cut a release without a code change, or to re-publish, trigger the workflow manually with `main` selected as the workflow ref.
 
 ### Manual fallback