Trigger CI on next, not only main (closes #122)

check.yml ran only on push to main and pull_request against main. Under
the current workflow every unit is a PR based on next, and next is
pushed to on each squash-merge, so neither got a CI run; the milestone
PR from next to main was the first place a broken next would surface.
Add next to both the push and pull_request branch lists so unit PRs and
next itself are checked. The workflow is otherwise unchanged: same
pinned actions/checkout sha, same script/cibuild step. README's
Entrypoints section and TODO.md's log record where CI now runs.

Model: opus-4-8

TODO.md

@@ -25,6 +25,12 @@ release" is exactly the contradiction
 
 # Completed Steps
 
+- 2026-09-21: Made `.gitea/workflows/check.yml` run on pushes to `main`
+  and `next` and on pull requests against either, so unit PRs (whose
+  base is `next`) and `next` itself get a CI run instead of relying on a
+  local `make check`
+  ([issue #122](https://git.eeqj.de/sneak/vaultik/issues/122)).
+
 - 2026-08-10: Moved every lint run into its own container, as a build
   step ([issue #113](https://git.eeqj.de/sneak/vaultik/issues/113)).
   New root `Dockerfile.lint`, built by `script/lint`, runs