ci: run Frontend checks and Terraform CI on PRs to main and dev

Match backend 148 so a PR targeting origin/dev still gets the required
checks. Push remains main only.

.github/workflows/ci-terraform.yaml

@@ -6,7 +6,7 @@ name: Terraform CI
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
     paths:
       - "terraform/**"
       - "scripts/**"

.github/workflows/ci.yaml

@@ -2,7 +2,7 @@ name: Frontend checks
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
   push:
     branches: [main]
   workflow_dispatch: {}
@@ -26,7 +26,7 @@ jobs:
     # checks in scripts/governance-check.mjs (godfile ratchet, changed-file
     # maintainability gate, Terraform fmt/validate, Terraform import-plan
     # guard, HCP run guard, CloudFront verify, GitHub workflow shell, and G13
-    # app/Terraform isolation).
+    # app/Terraform isolation). Runs on PRs to main or dev; push is main only.
     # If the reusable workflow is later confirmed to run every gate, this job
     # can be slimmed to `npm run governance`.
     #

QUALITY_GATES.md

@@ -68,7 +68,7 @@ isolation). A task is not done until this is green.
   of the reusable workflow.
 - **Terraform CI ([`.github/workflows/ci-terraform.yaml`](.github/workflows/ci-terraform.yaml)):**
   fmt, `init -backend=false`, validate, import-plan unit tests, and G13
-  classifier unit tests on `terraform/**` changes.
+  classifier unit tests on `terraform/**` changes for PRs to `main` or `dev`.
 
 ## Toolchain pin