Why must main() never return on a bare-metal system?

Because there's nowhere to return to. On a hosted system, main returns to the C runtime, which returns to the OS, which reclaims the process. On bare metal there is no OS and no caller beyond the startup code, the reset handler calls main as essentially the last thing it does. If main returns (or falls off the end), control goes back to the startup code, which on a correctly written runtime traps in an infinite while(1) to contain it; but the device is now doing nothing useful, peripherals may be left in arbitrary states, and if the trap weren't there, the PC could run off into whatever follows in memory and execute garbage, likely faulting. So bare-metal main is designed as a non-terminating super-loop (while(1) { ... }) or it hands control to an RTOS scheduler that never returns. Treating main as a function that returns is a hosted-programming habit that doesn't fit the bare-metal model.