Restrict server-edition deploy environment to main branch

## Problem

The GitHub OIDC workload identity pool provider in `terraform/gcloud_auth.tf` validates `repository_owner` and `environment` claims, but does not restrict by branch. Because deploy permissions are bound to `attribute.repository/fullstaq-ruby/server-edition`, workflows from non-main branches in `fullstaq-ruby/server-edition` can potentially authenticate if they run in the `deploy` environment.

## Proposed Change

Add a `ref` restriction to the deploy pool's attribute condition:

```hcl
attribute_condition = "assertion.repository_owner == 'fullstaq-ruby' && assertion.environment == 'deploy' && assertion.ref == 'refs/heads/main'"
```

## Considerations

Review whether non-main branches ever need deploy access (e.g., release branches). If so, use a prefix match instead of exact match.

Start in terraform/gcloud_auth.tf by locating the GitHub OIDC workload identity pool provider and its deploy attribute condition. Review whether release branches need deploy access, then validate the Terraform configuration; done means non-main branch workflows cannot authenticate to the deploy environment unless an explicitly approved branch policy allows them.

Written by the indexing model from the issue text.