feat(workflow): relax branch naming — guard main, allow any feature branch

[Mpfk]

Summary

• Adds an explicit guard in workflow-policy.yml that rejects PRs opened directly from main (defense-in-depth alongside the local branch-guard hook)
• Removes the issue/{N} branch-naming prescription from the 010-branch-guard.sh error message — any feature branch with a closing reference now works first-class
• Adds two new bats tests: main branch source is rejected; any named feature branch with a closing reference passes

The linkage logic was already branch-agnostic (issue/{N} OR closing reference). This change fills the one gap (no main-branch guard) and updates messaging to match.

Test plan

• bats tests/ — 65/65 pass
• New test: PR from main branch fails even with closing reference
• New test: any named feature branch with closing reference passes
• Existing issue/{N} tests unchanged (backwards compatible)

Closes #73

🤖 Generated with Claude Code