Git workflow

How changes get into main.

Every push to main deploys the live site, so main must always work.

Nobody commits to main directly; every change is a pull request.
Pull requests need one approving review and passing checks (lint, type check, build, rules tests).
If your pull request breaks a check or gets change requests, you fix it in the same pull request.
Keep pull requests small and about one thing.
Changes to firestore.rules need tests in tests/rules.

Name branches feature/<name>, fix/<name> or docs/<name>, and add a line to the changelog's Unreleased section.

The full version is docs/GIT_WORKFLOW.md.