[M0] Enforce the main-branch ruleset

[arthurpanhku]

Goal

Make repository governance enforceable on main.

Scope

Configure the main-branch ruleset to require pull requests, passing CI and Plan Gate checks, resolved conversations, and CODEOWNERS approval for sensitive changes.

Acceptance criteria

• Direct pushes and force pushes to main are blocked.
• Backend, frontend, and Plan Gate checks are required and current.
• Review conversations must be resolved before merge.
• Sensitive-path changes require CODEOWNERS approval.
• Bypass permissions are minimal, documented, and auditable.
• A dry-run pull request demonstrates that every required gate is enforced.

Dependencies

Implement after the CODEOWNERS and Plan Gate checks have stable names.