chore: sync protect-main.sh to canon v0.2.6

[WorldRover]

Summary

• Syncs scripts/protect-main.sh to worldrover-starter v0.2.6 (worldrover-starter#45, #46, #47)
• Accepts optional OWNER/REPO first arg (matches init-labels.sh interface)
• Space-aware / heuristic distinguishes repo args from check-context strings like CI / job (event)
• Post-apply verification warns when a required context isn't found in recent CI runs (prevents silent "Expected — Waiting" forever)

Test plan

N/A — script change only; no behavior change for the common case (no args).

Follow-ups

• Update stamp to v0.2.6 after merge

Closes #