Add branch protection and required validation checks for Agent Machine

[mdheller]

Context

Agent Machine now has real PR-triggered GitHub Actions validation proof through PR #9 / workflow run 25322297618. The bootstrap substrate is structurally complete for dry-run runtime-control use, but main-branch push workflow visibility remains an open follow-up.

Objective

Add branch protection and required validation checks once main-branch workflow visibility is confirmed.

Acceptance criteria

• Confirm the validation workflow is visible for the relevant protected branch/ref.
• Require the validate workflow/job before merging to main.
• Document the required check name and branch protection settings.
• Preserve make validate as the canonical local validation command.
• If connector visibility differs from GitHub UI visibility, document the distinction in Issue Verify GitHub Actions visibility for Agent Machine validation workflow #2 and BOOTSTRAP_STATUS.md.

Related artifacts

• .github/workflows/validate.yml
• Makefile
• BOOTSTRAP_STATUS.md
• Issue Verify GitHub Actions visibility for Agent Machine validation workflow #2
• PR Harden validation workflow for bootstrap proof #9 / workflow run 25322297618

[mdheller]

Branch-protection policy update:

The required validation job name is now documented in docs/architecture/branch-protection.md:

Validate contracts, examples, CLI, formula, and docs

Known green validation runs:

• PR Harden validation workflow for bootstrap proof #9 — workflow run 25322297618
• PR Add image digest pinning and provenance strict mode #11 — workflow run 25327418937
• PR Add deterministic release evidence bundle #14 — workflow run 25335379781
• PR Add signed release bundle envelope and branch protection docs #17 — workflow run 25342083882

Recommended protected-branch settings for main remain:

• require pull request before merging;
• require status checks to pass before merging;
• require the validation job above;
• require branches to be up to date before merging once concurrent work increases;
• restrict bypasses to admins only for emergency remediation;
• keep make validate as the canonical local validation command.

This issue should remain open until the repository branch-protection settings are actually configured and the required check appears consistently for main.