chore(governance): branch-protection policy + versions manifest fix

[beengud]

Addresses #5 #6 #7.

Context

Most of the docs-governance scaffolding from these issues already exists on main (CODEOWNERS, release.yml, docs-lint.yml with markdownlint/link-check/front-matter/structure/phage-policy jobs, docs/CONTRIBUTING.md, docs/STRUCTURE.md, docs/RELEASE.md, versioned docs under docs/versions/, README references). This PR fills the remaining file-creatable gaps rather than re-creating what's there.

What this PR adds/fixes

#6 — Release Pipeline & Branch Protection

• .github/branch-protection.json — machine-readable ruleset for main: require PR + 1 approving Code Owner review, the five docs-lint status checks (referenced by their exact job name: values), strict/up-to-date checks, linear history, conversation resolution, no force-push, no deletion. enforce_admins and required_signatures are off by default with inline notes on how to enable.
• scripts/apply-branch-protection.sh — admin helper that strips the doc-only fields and PUTs the ruleset to /repos/{owner}/{repo}/branches/main/protection via gh api.
• docs/BRANCH_PROTECTION.md — policy summary table, the required-check job-name list, apply (script + GitHub UI) and verify steps, and an explicit callout that applying protection is admin-only.
• docs/RELEASE.md — corrected the "Required status checks" list (it listed markdown-lint/link-check/etc.; the real job names are Markdown Linting, Link Validation, Front Matter Validation, Structure Validation, Phage Policy Enforcement) and linked the new policy doc.
• .github/CODEOWNERS + README.md — reference the new governance files.

#5 / #7 — Versioning manifest fix

• docs/versions.json — latest pointed at vNEXT (a development build) and omitted v1.0.0, even though v1.0.0/ exists on disk and the docs/versions/latest symlink targets it. Now latest = v1.0.0 and the manifest lists it as stable, so the manifest matches reality.
• docs-lint.yml phage-policy allowlist updated so the new BRANCH_PROTECTION.md governance doc is permitted in docs/ root.

Human-only follow-ups (cannot be done from a PR)

• Apply branch protection on main — run ./scripts/apply-branch-protection.sh raibid-labs/docs main with an admin token, or configure it in Settings → Branches. The default Actions GITHUB_TOKEN cannot set this. Steps documented in docs/BRANCH_PROTECTION.md.
• Optional: enable required signed commits / enforce_admins if the org mandates them (flip the flags in branch-protection.json and re-apply).
• crates.io / homebrew publishing from Release Pipeline & Branch Protection #6 is N/A for this docs (Quartz) repo — the release workflow already builds the site, tars artifacts, and publishes a GitHub Release with SHA-256 checksums.

Validation

• versions.json and branch-protection.json: valid JSON; jq-extracted payload matches the GitHub branch-protection API schema.
• docs-lint.yml: valid YAML; structure + phage-policy checks pass locally.
• apply-branch-protection.sh: bash -n clean.
• markdownlint: new docs/BRANCH_PROTECTION.md is clean under repo .markdownlint.json; README/RELEASE error counts unchanged vs origin/main (no new violations introduced — there are pre-existing markdownlint errors on main, left untouched and out of scope).
• Full Quartz npm run build not run: node_modules not installed and changes are markdown/JSON/YAML/shell only, touching no Quartz code.

🤖 Generated with Claude Code