Configure branch protection rules for public repo

[dhilgaertner]

Parent Issue

Part of #52 — Open Source Readiness & Launch Strategy

Overview

Set up branch protection rules on main to ensure code quality and prevent accidental force pushes in a public repository.

Scope

• Protect main branch
• Require pull request reviews (at least 1 approval)
• Require status checks to pass before merging (depends on CI — see CI workflow issue)
• Disable force pushes to main
• Disable branch deletion for main
• Consider: require signed commits (optional, may add friction for new contributors)
• Consider: require linear history (squash or rebase merges only)

Dependencies

• CI workflow must be in place first so required status checks can reference it

Acceptance Criteria

• main branch is protected
• PRs require at least 1 review approval
• CI checks are required to pass
• Force pushes are blocked