* ci: add pre-push hook to prevent direct pushes to main * ci: grant pull-requests read permission to commitlint job