chore: enforce branch protection on main (reviews, checks, no force-push)

[suchapalaver]

Context

The repository is going public (Epic #561). The default branch main currently has no enforced protection, so the "all changes go through reviewed PRs" practice is procedural, not technically enforced.

Current state

• gh api repos/semiotic-agentium/agentium-os/rulesets returns 0 rulesets.
• Classic branch protection on main could not be confirmed as set (the API returned empty). Verify directly in Settings → Branches.
• Recent history shows changes do arrive via PRs in practice (sampled main commits all traced to merged PRs), but nothing prevents a direct push, an unreviewed merge, or a force-push.

Why it matters

Two reasons, both sharpened by going public: (1) SOC 2 change-management expects the review control to be enforced, not just followed; an auditor samples for this. (2) On day one as a public repo, an unprotected main can be force-pushed or merged without review — exactly the integrity risk you do not want on a partner-facing project. (It also structurally prevents a future history-rewrite force-push.)

Acceptance criteria

• main requires a pull request before merging.
• At least one approving review is required, and the approver cannot be the PR author (segregation of duties).
• Required status checks include the existing CI (nextest, and the secret-scan/gitleaks lane).
• Force-pushes and branch deletion on main are blocked.
• Protection is enforced for administrators.
• (Consider) Require signed commits.

Suggested approach

Use a GitHub ruleset (or classic branch protection) on main in repo settings. This is an admin/settings action, not a code change.

Out of scope

Org-level policies; protection for non-default branches.

Part of #561.

[suchapalaver]

@adebnar Still a few things to take care of here