Public readiness: branch protection / rulesets for main

[DocGerd]

Protect main via a ruleset: require PRs (no direct pushes — note: plan-amendment docs commits have gone straight to main during development; this stops at public time), require the app CI check (and the future data-integrity + CodeQL checks) to pass, block force pushes and deletions, require linear-ish history as preferred (current convention is merge commits — decide and encode), optionally require review for outside contributions once public.

Part of the public-readiness batch — do not implement yet.

🤖 Generated with Claude Code

[DocGerd]

Project-gate condition (from the Phase F final review): this ruleset MUST explicitly include required status checks (the app CI job and the e2e job) — not just force-push/deletion protection. Context: deploy.yml triggers on push to main gated only by the build (tsc), so until this issue lands, direct pushes to main can deploy test-broken code. Accepted for v0.1.0 with this note in the release notes.

[DocGerd]

Implemented as ruleset protect-main (id 19043136, enforcement: active) on the default branch:

• PRs required — no direct pushes to main; 0 approvals required (solo repo — a 1-approval floor would deadlock self-merges), review threads must be resolved before merge (matches the existing self-review workflow).
• Required status checks: app and e2e (both run on every PR; e2e did not exist when this issue was filed and is included because it gates the PWA/offline behavior that deploy ships on merge). Strict mode ON — branches must be up to date with main before merging, so checks always ran against the exact tree that deploys.
• Force pushes and deletions blocked on main.
• Merge-commit convention encoded: allowed_merge_methods: ["merge"] — no linear-history rule, per the existing history convention (decided as this issue asked).
• No bypass actors — admin can still edit/disable the ruleset in an emergency, but cannot silently push around it.

Deferred (re-add to the ruleset when the workflows exist): data-integrity check, CodeQL. "Require review for outside contributions" is covered by the check + PR gate for now; revisit if external contributors appear.