Document and enforce branch protection requiring the validate check to pass before merge

[knytcomics-ui]

Problem

CI runs npm run validate on every push/PR (per .github/workflows/ci.yml), but nothing in the repo confirms that this check is actually a required status check for merging into main — if branch protection isn't configured, a failing validation run doesn't stop a merge, silently defeating the entire purpose of having the check.

Requirements

• Audit the current branch protection settings for main (via gh api repos/Gryd-lock/grydlock-testkit/branches/main/protection or the repo Settings UI) and confirm whether the validate job is a required status check.
• If not configured, either configure it directly (if the assignee has admin rights) or write up the exact required configuration for a maintainer to apply, including: required status checks, whether force-pushes to main should be blocked, and whether at least one approving review should be required for changes to destinations.json/scores.json (ties into the CODEOWNERS issue).
• Document the final branch-protection policy in a short section of the README or a GOVERNANCE.md.

Acceptance Criteria

• A PR with an intentionally broken fixture cannot be merged via the GitHub UI while the validate check is failing.
• The policy is written down somewhere a new maintainer would find it.

Part of the Gryd-lock organization. This repo supplies the labelled testnet fixtures and stub scores consumed by grydlock-oracle-adapter's StubOracle and evaluated end-to-end by grydlock-research.

[OluRemiFour]

Hi Maintainer,
Interested in working on this issue. I'll implement the requested changes and ensure everything is properly tested before submission.