chore: replace branch-protection config with repository ruleset

Rulesets are the current GitHub mechanism and support role-based bypass
on personal repos. Applied as ruleset "main-protection": PR required
with 1 code-owner approval, no force-push, no branch deletion; repo
admins bypass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Nael-Nathanael

.github/branch-protection.json

@@ -0,0 +1,29 @@
+{
+  "name": "main-protection",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "require_code_owner_review": true,
+        "dismiss_stale_reviews_on_push": true,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    }
+  ],
+  "bypass_actors": [
+    { "actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always" }
+  ]
+}