[infra] Four repos have no enforced review check (needs a review workflow first)

[twistedmelonman]

Follow-up from the W0 protection pass (2026-09-05). Eight repos were brought up to the dotfiles/claude-config exemplar; these four could not be, because there is no review workflow to require.

Repo	State	Workflows present
smartwatermelon/.github	protected, zero required checks	claude.yml only
smartwatermelon/claude-config-backup	unprotected	none
smartwatermelon/superpowers	unprotected	none
smartwatermelon/superpowers-marketplace	unprotected	none

Adding branch protection here would be worse than leaving it: a required-checks list of [] reports "protected" while enforcing nothing. That is the false-OK pattern this backlog already tracks — smartwatermelon/.github is currently in exactly that state and reads as protected in a naive audit.

Each needs claude-blocking-review.yml added and verified green before protection means anything. Note claude.yml is the interactive workflow, not the review one — having it is not sufficient.

Decide per repo whether a review gate is wanted at all:

• claude-config-backup is a backup mirror; possibly intentional.
• superpowers / superpowers-marketplace may be deliberately unguarded.
• smartwatermelon/.github is org-wide config and probably should be gated.

Exemplar settings for whichever get adopted: required check claude-review / run-review, strict: true, required_conversation_resolution: true, 0 approving reviews, enforce_admins: false, force-pushes and deletions off, allow_auto_merge: true, delete_branch_on_merge: true.