chore: repo settings - branch protection, required CI, tag-triggered release

[espetro]

Effort: XS\n\nProtect main + develop branches. Require CI for PRs. Configure tag-push release workflow trigger.