docs(basebranches): describe the dev/default branch split

README.md

@@ -23,8 +23,17 @@ merge themselves once approved. Registries without a release timestamp get the
 `wait-3d` label instead, and the age gate merges those. The edge (`caddy/**`),
 `_legacy/**` and worktree compose files are out of scope.
 
+Updates are split across two base branches. Images target the default branch,
+so an image update deploys as soon as it merges. Code dependencies target
+`dev` and never touch the default branch on their own; you pull `dev` and
+merge it yourself when you want that code in production. The split is two
+`matchBaseBranches` rules, so the same update is never offered on both
+branches. A repo using this preset therefore needs a `dev` branch.
+
 The repo has to carry the `renovate`, `wait-3d` and `deps-code` labels before
-the first run: Renovate fails on a label that does not exist.
+the first run: Renovate fails on a label that does not exist. It also has to
+have a `dev` branch, otherwise Renovate skips that base branch and code
+updates are never proposed.
 
 Extending this preset does NOT subscribe a repo to anything. The bot only visits
 repos listed in `repositories` in its own config