Default branch is main across GitHub, CI, and dependency bots

## User story

As a **contributor**, I want **`main` to be the default branch across GitHub, CI, and dependency bots** so that **my PRs target the same branch everyone else does and CI fires on the same ref**.

## Why

The GitHub default is `master`, but `.github/workflows/pre-commit.yml` triggers on `branches: [main]`. That means pushes to `master` do not run the pre-commit workflow — a silent gap. Renovate's PR #389 also proposes targeting `develop`, `main`, and `master` simultaneously. A single canonical branch removes drift.

## Acceptance criteria

- [ ] Default branch on GitHub is renamed `master` → `main`.
- [ ] Every workflow in `.github/workflows/*.yml` that references `main` or `master` uses `main` only.
- [ ] `renovate.json` (when #389 is merged) has `baseBranchPatterns: ["main"]`.
- [ ] README, CONTRIBUTING, and any docs that link to `…/blob/master/…` are updated to `…/blob/main/…`.
- [ ] Open PRs have their base branch retargeted to `main`.
- [ ] Branch protection rules moved from `master` to `main`.

## Out of scope

- Deleting the old `master` ref (GitHub keeps a redirect; leaving it is safer for external forks).

## Notes

- Target release: **none — chore**
- Hard prerequisite for the release-please and Renovate chores.
- Source: modernization assessment §1, §4.