Enable branch protection + merge queue once GitHub plan allows private-repo rules

[zts212653]

Context

We implemented CI gates and collaboration guardrails in main, but API-level branch protection/ruleset setup is currently blocked by GitHub plan limits for this private repository.

Observed API response:

• GET /repos/{owner}/{repo}/branches/main/protection -> 403 Upgrade to GitHub Pro or make this repository public
• GET /repos/{owner}/{repo}/rulesets -> same 403

What is already done

• CI gate workflow in main:
  • lint, build, smoke-tests, risk-matrix, test-skip-guard, lockfile-policy
• PR template, CODEOWNERS, agent rules, governance docs
• delete_branch_on_merge=true

Action when plan is upgraded (or repo made public)

Configure branch/ruleset for main:

1. Require PR before merge
2. Require 1 approval
3. Dismiss stale approvals
4. Require CODEOWNERS review
5. Require conversation resolution
6. Require status checks (phase rollout):
   • phase-1 required: lint, build
   • phase-2 required: smoke-tests
   • phase-3 required: risk-matrix, test-skip-guard, lockfile-policy
7. Require branch up-to-date
8. Disable direct push / force push
9. Enable merge queue (if available)

Reference docs

• /docs/governance/branch-protection.md
• /CONTRIBUTING.md
• /.github/workflows/ci-gate.yml