Branch protection on main

[wimaan3]

Context

Protect the default branch before opening contributions.

Acceptance criteria

• Require PR + >=1 review + passing status checks to merge.
• Require linear history; block force-push/deletion (except admin).
• Decide admin enforcement.

[wimaan3]

Branch protection is plan-gated on the private free repo (verified HTTP 403: 'Upgrade to Pro or make public') — for both classic protection and rulesets. Deferred to publish time; exact config captured in docs/notes/PUBLISH-CHECKLIST.md §2. Free once public.