[BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset

[Joncallim]

Parent programme: #333
Execution mode: implementation
Depends on: none
Blocks: #352, #357

Bug Summary

Forge's repository release gates are not enforced by GitHub on main. The branch is currently unprotected, so direct pushes or unchecked merges can bypass the evidence gates Forge relies on for trust.

Current Behaviour

GitHub reports main with protected: false and required-status-check enforcement off. Forge already treats PR Contract Check and Web CI as merge gates by process, but enforcement depends on operators/agents voluntarily honoring that process.

Expected Behaviour

GitHub itself enforces the base repository boundary for main: changes enter through PRs; PR Contract Check and Web CI are required; branch freshness/merge-queue semantics are explicit; force pushes/deletion are blocked; normal agents/bots cannot bypass; break-glass is explicit/operator-only/auditable.

This issue deliberately does not require the external forge/host-boundary-controller App/check to exist yet. #357 depends on this base ruleset plus #352 and owns binding the exact external controller App/check for S6 release classes. #348 must leave a safe extension path without blocking ordinary PRs on an unprovisioned controller.

Reproduction Steps

1. Query GitHub branch protection/rulesets for main.
2. Observe protected: false / required checks enforcement off.
3. Confirm the repository therefore does not itself reject a normal direct-push or unchecked merge path based on Web CI/PR Contract status.

Impact

Forge is building toward autonomous writers but its outer repository boundary does not enforce the checks those writers are supposed to respect. A mistaken/compromised agent/operator path can bypass CI/review discipline where repository truth is finalized.

Severity

Critical - security/control-plane release boundary is unenforced.

Implementation Sequence

1. Inventory actual check identities — current Web CI/PR Contract workflow/check names, events, forks, merge mode and current rulesets/bypass actors.
2. Design minimal base ruleset — PR-only main, required Web CI + PR Contract, freshness/merge-queue choice, no force/delete, explicit operator break-glass.
3. Apply base protection using repository settings/API without adding the not-yet-provisioned external S6 check.
4. Positive/negative proof — disposable PR merges only when required checks pass; direct push/force/delete/failing-check paths rejected.
5. Automation authority review — prove ordinary GitHub Actions/agent tokens cannot bypass; emergency bypass identity remains narrow.
6. Document extension point for [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 — exact mechanism by which release-specific external controller App/check will later be added without weakening base checks or blocking unrelated changes.
7. Final effective-state capture — API/ruleset output and concise break-glass/recovery documentation.

Primary Code / Control Seams To Inspect First

• repository branch/ruleset settings/API
• .github/workflows/web-ci.yml
• .github/workflows/pr-contract-check.yml
• agent/issue workflows with write permissions
• docs/operators/host-boundary-controller-v2.md only to understand later [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 extension
• repository agent instructions/merge guidance

Orthogonal Checkpoints

1. Check identity: exact names/events, same-name status spoofing, skipped checks and fork behavior.
2. Bypass authority: owner/admin/Actions/bot identities, emergency path and auditability.
3. Merge semantics: stale branch, merge queue/freshness, draft/failing/missing checks, branch deletion/force push.
4. Availability: base ruleset must not deadlock ordinary development on an external controller [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 has not provisioned.
5. Supply-chain handoff: give [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 the exact required workflow set whose dependencies become trust roots.
6. S6 handoff: give [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 a safe documented way to add exact external App/check only for applicable release flows.
7. Rollback/recovery: prove break-glass is narrow and followed by post-bypass verification.

Acceptance Criteria

• GitHub reports main protected by an effective branch policy/ruleset.
• Normal direct pushes to main are rejected.
• A PR cannot merge while PR Contract Check is failing/missing.
• A PR cannot merge while Web CI is failing/missing.
• Required branch freshness or equivalent merge-queue behavior is explicit/tested.
• Force pushes and branch deletion are rejected.
• Normal GitHub Actions/agent tokens cannot bypass required checks.
• Emergency bypass is explicit, minimal, operator-only, documented and followed by post-bypass verification.
• Ordinary PRs do not require an unprovisioned forge/host-boundary-controller check at this stage.
• A documented extension path exists for [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 to bind the exact external controller App/check without weakening base protection.
• Repository/agent docs state model review output is never a substitute for enforced GitHub gates.
• A disposable branch/PR demonstrates positive and negative rule behavior before close.

Out of Scope

• Pinning external Action dependencies ([BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352).
• Provisioning/binding the external S6 controller App/host/evidence lane ([OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357).
• Changing application runtime authorization models.
• Requiring privileged host checks on every ordinary docs/code PR.
• Broad organization-wide GitHub governance unrelated to this repository.

Implementation Scope

Small-to-Medium but consequential repository-governance change; target one ruleset/configuration operation plus a small docs/evidence PR if needed, with live negative tests before close.

Environment

• Repository: Joncallim/Forge.
• Baseline: current main after ADR 0014; branch protection observed disabled during the post-VNext audit.

Technical Notes

Do not broaden into #352/#357. Close only after the effective GitHub rule is observed/tested, not after merely drafting settings or documentation.

[github-actions]

FORGE issue validation

This Bug issue now matches the required FORGE template structure.
The validator applied ready-for-agent and removed needs-clarification if it was present.