Your team uses GitHub Actions with an environment named 'production' that has required reviewers configured. Auditors report that a developer was able to trigger a deployment to the production environment from a short-lived feature branch by manually running the workflow. Compliance requires that deployments to production can ONLY be initiated from the 'main' branch, while still keeping the required-reviewer approval in place. What should you configure to meet this requirement with the least effort?