This achieves a few goals:

- ensures that only `main`, `ci` can be used
- ensures that no `replica: true` is used
- ensures that legacy config is properly transformed
  to use `main:`
- validate that `main:` is a first entry in a hash