docs: say to alert on base-branch failure

[jtomaszewski]

Problem

The README's Where to run it section tells you to run the check on push to the base branch, and calls that run "what makes the guard never silently wrong."

It isn't, on its own — and following the README as written gets you a guard nobody hears. When the check fails on push, the colliding PR has already merged and its author has moved on. The only signals left are a red mark on a commit nobody revisits and whatever mail GitHub sends the person who pressed Merge. Detection nobody is told about is not detection.

The timing is what makes this matter rather than being a nitpick: a duplicate id costs minutes to fix the hour it lands, and a full citation sweep a month later once it is in tracker tasks, merged PR titles and code comments. The push alert is the thing that buys the cheap version.

Found the honest way — by shipping the silent version. fullstackhouse/tournee adopted this action with a push: main trigger and no alerting step, while every other workflow in that repo notifies its alerts channel on a main failure. The one guard whose failure nobody is watching for was the one that stayed quiet (tournee#1041 fixes it there). The original pre-extraction version of this check wired itself into a shared notify-failure job and said so in a comment; the extraction dropped it and the README never asked for it back.

Change

Docs only.

• New bullet in Where to run it with a snippet, framed as "whatever your repo already uses for CI alerts" rather than mandating slack-notify-action.
• Guarded on github.ref_name == 'main' — on a pull_request the red check already sits on a PR its author is looking at, so alerting there is noise.
• Drops the "never silently wrong" claim from the push bullet.

No change to action.yml or scripts/check.sh. Alerting stays the consumer's step rather than an input: it is repo-specific (channel, token, transport) and the action has no business knowing about Slack.