docs: enable branch protection for main branch

[magnus919]

Description

Once a CI pipeline is in place (see #69) and consistently green on main, the main branch should have branch protection enabled to prevent untested PRs from being merged.

What to enable

In repository Settings → Branches → Add branch protection rule for main:

• Require status checks to pass before merging
  • Require the CI workflow (pytest) to pass
• Require pull request reviews before merging (optional, but recommended)
• Prevent direct pushes to main

Why

Currently anyone with write access can push directly to main or merge a PR with failing tests. With a CI pipeline that runs on PRs (tracked in #69), the check results would be available to gate merging — but only if branch protection is enabled to enforce them.

Notes

• This requires repository admin access — it cannot be implemented as a PR. A maintainer (e.g. @rajkripal) needs to configure this in the repository settings.
• This is the last step in the CI infrastructure chain (see discussion CI Infrastructure and Test Health — backlog and dependency chain #67 for the full dependency graph).
• Can be done independently after CI is green and stable.

Related

• Discussion CI Infrastructure and Test Health — backlog and dependency chain #67 (overall CI infrastructure backlog)
• Issue ci: add GitHub Actions workflow for continuous integration #69 (CI pipeline — this depends on that being operational)

This issue was filed on behalf of Magnus Hedemark by Jasper, his AI agent. If you need to discuss this with Magnus directly or want clarification about intent, please @mention him.