Refuse --dist anywhere but main

The bundle became one file per branch, but the frontend dists did not: they are
still frontend-dist-subpath-{ops,shopdb}, fixed paths, and update-prod-server.cmd
robocopies the shopdb one onto the production server with /MIR - a full mirror -
with no idea which branch built it.

So --dist from a site branch would have replaced production's frontend with
unreleased work at the next deploy, silently, and nothing downstream could have
told. Worse than the bundle collision it was sitting beside, because the dist is
what actually lands on the server.

Branch-qualifying the directories would only move the trap to whoever pointed a
deploy at the wrong one. Production runs the product, so the export now refuses
and says which commits to promote instead.

Scope: product

tools/export-github.sh

@@ -261,6 +261,31 @@ echo "bundle: $BUNDLE"
 # --- 6. optional per-instance dists (both bases: /ops = dev, /shopdb = prod) ---
 # Two instances run on the box; each needs its own base-path build. Always
 # rebuild BOTH so prod never ships a stale frontend.
+# --dist IS MAIN ONLY.
+#
+# These paths are not branch-qualified and cannot safely be: update-prod-server
+# .cmd robocopies frontend-dist-subpath-shopdb onto the production server with
+# /MIR, a full mirror, and has no idea which branch built it. So --dist from a
+# site branch would replace production's frontend with unreleased work at the
+# next deploy, silently, and the deploy script could not tell.
+#
+# Branch-qualifying the directory would leave the same trap for whoever pointed
+# a deploy at the wrong one. Production runs the product; a site branch has no
+# business producing the artefact production installs.
+if [ "$BUILD_DIST" = 1 ] && [ "$BRANCH" != "main" ]; then
+  echo "REFUSED: --dist on branch '$BRANCH'." >&2
+  echo >&2
+  echo "The dist directories are what update-prod-server.cmd mirrors onto the" >&2
+  echo "production server, and they are not branch-qualified. Building them" >&2
+  echo "from '$BRANCH' would put unreleased work on production at the next" >&2
+  echo "deploy, with nothing to reveal it." >&2
+  echo >&2
+  echo "Promote the commits to main and export from there:" >&2
+  echo "    tools/wj-status.sh" >&2
+  echo "    tools/promote-to-main.sh <sha> ..." >&2
+  exit 1
+fi
+
 if [ "$BUILD_DIST" = 1 ]; then
   cd "$WORK/frontend"
   for base in ops shopdb; do