Trigger CI on next, not only main (closes #122)

check.yml ran only on push to main and pull_request against main. Under
the current workflow every unit is a PR based on next, and next is
pushed to on each squash-merge, so neither got a CI run; the milestone
PR from next to main was the first place a broken next would surface.
Add next to both the push and pull_request branch lists so unit PRs and
next itself are checked. The workflow is otherwise unchanged: same
pinned actions/checkout sha, same script/cibuild step. README's
Entrypoints section and TODO.md's log record where CI now runs.

Model: opus-4-8

README.md

@@ -716,6 +716,8 @@ them. We provide:
   then the product image). Either failing fails the script. It runs the
   checks in the same containers CI does, from a clean copy of the tree,
   so it also catches anything that depends on host state.
+  `.gitea/workflows/check.yml` runs it on every push to `main` and
+  `next` and on every pull request against either.
 
   It passes a fresh `--build-arg CHECK_EPOCH` to each build, unique per
   invocation, which both files declare immediately above their check