Protect the main branch with required review and CI

[kylymo]

Parent issue

Part of #885 — Update app's GitHub Apps and automation

Objective

Protect the main branch so required review and CI checks cannot be bypassed accidentally.

Evidence

• The repository currently has no branch protection configured for main.
• CI runs on pushes and pull requests to main, but checks are not enforced by branch rules.

Scope

• Require pull requests for changes to main.
• Require the appropriate CI status checks.
• Set the required approval count and stale-review behavior.
• Restrict force pushes and branch deletion.
• Decide administrator bypass rules.

Acceptance criteria

• main has an approved protection/ruleset configuration.
• Required CI checks are identified by stable names and enforced.
• The team documents the emergency-bypass procedure.
• A test pull request confirms the rules behave as intended.

Out of scope

Changing application source code or release branching strategy.