decision(security): enforce reviewed branch protection on main

[WalksWithASwagger]

Summary

Apply the reviewed GitHub branch-protection policy to main after its required checks exist and are green.

Context

• Depends on review: PR #305 dark-crystal style human gate #307, build: align fresh-clone setup with the canonical verification gate #321, and pipeline: make stop labels sticky and PR policy checks blocking #326.
• Roadmap phase: Phase 3 - workflow integration
• Relevant surface: GitHub repository settings only; no repository files are expected to change.
• Current behavior: documented enforcement and live repository enforcement may diverge.
• Desired behavior: pull requests and strict required checks protect main without introducing an unapproved review-count policy.

Implementation Notes

• This is a maintainer-operated external-state change.
• Re-read live protection before proposing a patch and record only non-sensitive settings.
• Require test, secret-scan, and policy only after those exact checks are green on main.
• Preserve protection against force pushes and deletion.

Acceptance Criteria

• Pull requests are required for main.
• Strict required checks are test, secret-scan, and policy.
• Conversation resolution and admin enforcement are enabled.
• Force pushes and branch deletion remain blocked.
• No independent approving-review count is added unless KK separately approves it.
• Redacted live API output proving the final setting is attached to this issue.

Tests/Evals

• Use a safe noncompliant test PR or equivalent read-only proof that missing policy checks block merge.
• Do not merge the test PR.

Verification

• gh api repos/WalksWithASwagger/rafiki/branches/main/protection
• Confirm current main runs test, secret-scan, and policy successfully before changing settings.

Agent Instructions

• Do not change settings automatically.
• Do not expose tokens, actor lists beyond what GitHub already makes public to repository maintainers, or environment values.
• Do not merge, close, or create bypasses.

Human Checkpoints

• KK must explicitly approve the exact settings mutation in the execution turn.
• Stop if any required check name is unstable or absent on main.

Out of Scope

• Code changes.
• Merging pull requests.
• Adding bypass actors or weakening protections.
• Requiring a review count without a separate decision.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.