ci(branch-policy): allow hotfix and release branches into main

The policy accepted only `staging` as a head for main, so any change
production needed before the next promotion had nowhere to go: the PR was
unmergeable by CI and branch protection blocks direct pushes.

Accept `hotfix/*` and `release/*` heads as well. The naming requirement
keeps a direct-to-main change deliberate and visible, and the master
freeze plus the "features target staging" rule are unchanged. Document
the escape hatch and the need to land the same commit on staging.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/verify.yml

@@ -24,9 +24,14 @@ jobs:
             echo "master is frozen; target staging or main" >&2
             exit 1
           fi
-          if [ "$BASE_BRANCH" = "main" ] && [ "$HEAD_BRANCH" != "staging" ]; then
-            echo "Only staging may be promoted to main" >&2
-            exit 1
+          if [ "$BASE_BRANCH" = "main" ]; then
+            case "$HEAD_BRANCH" in
+              staging|hotfix/*|release/*) ;;
+              *)
+                echo "main takes staging promotions, or a hotfix/* or release/* branch for direct work" >&2
+                exit 1
+                ;;
+            esac
           fi
           if [ "$BASE_BRANCH" != "staging" ] && [ "$BASE_BRANCH" != "main" ]; then
             echo "Feature pull requests target staging; promotions target main" >&2