Merge relese into main

.husky/pre-push

@@ -1,18 +1,31 @@
 #!/usr/bin/env sh
 # --- pre-push hook ---
 #
-# Prevent direct pushes to main. All changes to main must go through a pull
-# request from the release branch. Versioning and releases are handled
-# automatically by GitHub Actions on merge.
+# Block direct pushes to main and release. All changes land through a pull
+# request; versioning and releases run in GitHub Actions on merge. Branch
+# deletions and pushes to any other branch are allowed.
 
 . "$(dirname "$0")/bin/dependency-check.sh"
 
-branch=$(git symbolic-ref HEAD 2>/dev/null | sed 's|refs/heads/||')
+zero="0000000000000000000000000000000000000000"
 
-if [ "$branch" = "main" ] || [ "$branch" = "release" ]; then
-	echo ""
-	echo "ERROR: Direct pushes to '$branch' are not allowed."
-	echo "Open a pull request instead."
-	echo ""
-	exit 1
-fi
+# Git streams the refs being pushed on stdin, one per line:
+#   <local ref> <local sha> <remote ref> <remote sha>
+while read -r local_ref local_sha remote_ref remote_sha; do
+
+	# A deletion sends an all-zeros local sha — let it through.
+	if [ "$local_sha" = "$zero" ] || [ -z "$local_sha" ]; then
+		continue
+	fi
+
+	case "$remote_ref" in
+		refs/heads/main | refs/heads/release)
+			echo ""
+			echo "ERROR: Direct pushes to '${remote_ref#refs/heads/}' are not allowed."
+			echo "Open a pull request instead."
+			echo ""
+			exit 1
+			;;
+	esac
+
+done