Add branch protection tip to PAT setup instructions

Remind users to enable branch protection on main so the PAT
can only be used to push the version branch, not write directly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: theoephraim

packages/bumpy/src/commands/ci-setup.ts

@@ -79,6 +79,9 @@ async function setupPat(rootDir: string, repo: string, pm: PackageManager): Prom
       ...PAT_PERMISSIONS.map((perm) => `   • ${pc.bold(perm)}`),
       '',
       '7. Click "Generate token" and copy the value',
+      '',
+      pc.dim('Tip: enable branch protection rules on your main branch to prevent'),
+      pc.dim('direct pushes — the PAT will only be used to push the version branch.'),
     ].join('\n'),
     'Create a fine-grained PAT',
   );