chore: stabilize main branch with dev workflow + PR guidelines

- Set dev as default branch, protect main (owner-only merge)
- Add CI trigger for PRs targeting dev
- Add PR template with checklist and branch targeting guide
- Add CONTRIBUTING.md with branch strategy and review criteria
- Update README clone command to use -b main for stable

.github/pull_request_template.md

@@ -0,0 +1,34 @@
+## Summary
+<!-- 1-2 sentences: What does this PR do and why? -->
+
+## Type
+<!-- Check one -->
+- [ ] Feature
+- [ ] Bug fix
+- [ ] Hotfix (targeting `main`)
+- [ ] Refactor
+- [ ] Docs
+- [ ] CI/CD
+
+## Target Branch
+<!--
+  ⚠️  IMPORTANT: Read before submitting!
+
+  - Features/bugfixes → `dev` (default)
+  - Hotfixes only → `main` (cherry-pick back to `dev` after merge)
+  - DO NOT target `main` for regular development
+-->
+
+## Checklist
+- [ ] `go build ./...` passes
+- [ ] `go build -tags sqliteonly ./...` passes (if Go changes)
+- [ ] `go vet ./...` passes
+- [ ] Tests pass: `go test -race ./...`
+- [ ] Web UI builds: `cd ui/web && pnpm build` (if UI changes)
+- [ ] No hardcoded secrets or credentials
+- [ ] SQL queries use parameterized `$1, $2` (no string concat)
+- [ ] New user-facing strings added to all 3 locales (en/vi/zh)
+- [ ] Migration version bumped in `internal/upgrade/version.go` (if new migration)
+
+## Test Plan
+<!-- How was this tested? -->

.github/workflows/ci.yaml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, dev]
 
 permissions:
   contents: read

CONTRIBUTING.md

@@ -0,0 +1,83 @@
+# Contributing to GoClaw
+
+## Branch Strategy
+
+```
+main (stable, protected — owner-only merge)
+  └── dev (default target for all PRs)
+        ├── feat/xxx
+        ├── fix/xxx
+        └── ...
+```
+
+### Rules
+
+1. **All PRs target `dev`** — `main` is frozen for stable releases
+2. **Hotfixes** — PR to `main`, then cherry-pick to `dev`
+3. **Releases** — owner merges `dev` → `main` when stable
+4. **Direct push to `main`** — blocked (ruleset enforced)
+
+### Branch Naming
+
+- `feat/description` — new features
+- `fix/description` — bug fixes
+- `hotfix/description` — urgent production fixes (target `main`)
+- `refactor/description` — code improvements
+- `docs/description` — documentation changes
+
+## PR Guidelines
+
+### Before Submitting
+
+```bash
+go fix ./...                        # Apply Go upgrades
+go build ./...                      # PG build check
+go build -tags sqliteonly ./...     # Desktop build check
+go vet ./...                        # Static analysis
+go test -race ./...                 # Tests with race detector
+```
+
+For web UI changes:
+
+```bash
+cd ui/web && pnpm build
+```
+
+### PR Review Criteria
+
+Based on our automated review checklist:
+
+- **Correctness**: No logic errors, nil dereference, race conditions
+- **Security**: Parameterized SQL, no hardcoded secrets, input validation
+- **Breaking changes**: API contracts, DB migrations, config format
+- **Tenant isolation**: All queries scoped by `tenant_id`
+- **i18n**: User-facing strings in all 3 locales (en/vi/zh)
+- **SQLite parity**: Changes compile with `-tags sqliteonly`
+- **Mobile UI**: `h-dvh` not `h-screen`, 16px input fonts, safe areas
+
+### Commit Messages
+
+Use conventional commits:
+
+```
+feat: add user preferences API
+fix: prevent race condition in session cleanup
+docs: update API reference for v2 endpoints
+refactor: extract provider retry logic
+```
+
+## Workflow
+
+```
+Developer                    Reviewer                 Owner
+    │                            │                      │
+    ├─ create feat/xxx ──────────┤                      │
+    ├─ PR → dev ─────────────────┤                      │
+    │                            ├─ review + approve    │
+    │                            ├─ CI passes ──────────┤
+    │                            │                      ├─ merge to dev
+    │                            │                      │
+    │                            │        (when stable) ├─ PR dev → main
+    │                            │                      ├─ merge → release
+    │                            │                      ├─ tag → CD triggers
+```

README.md

@@ -170,12 +170,14 @@ git tag lite-v0.1.0 && git push origin lite-v0.1.0
 ### From Source
 
 ```bash
-git clone https://github.com/nextlevelbuilder/goclaw.git && cd goclaw
+git clone -b main https://github.com/nextlevelbuilder/goclaw.git && cd goclaw
 make build
 ./goclaw onboard        # Interactive setup wizard
 source .env.local && ./goclaw
 ```
 
+> **Note:** The default branch is `dev` (active development). Use `-b main` to clone the stable release branch.
+
 ### With Docker
 
 ```bash