Branch protection rulesets: master + develop (with github-actions[bot] bypass on develop)

[haydenk]

Parent

Part of #14

What to build

HITL — requires repo admin access.

Configure branch protection rulesets (not classic protection — rulesets support per-actor bypass cleanly).

master

• Require PR
• Required status checks: ci / lint, ci / build (matrix), ci / test (matrix), branch-policy / validate-branch
• Require linear history
• Restrict pushes (no direct push)
• Auto-delete head branch on merge

develop

• Same as master, plus:
• Bypass actor: github-actions[bot] — lets the back-merge PR (gitflow-release.yml: tag + back-merge + invoke release on master merge (replaces tag.yml) #21) merge without re-running CI on content that already passed on the master path.

Document the policy and the rationale for the bot bypass in CONTRIBUTING.md.

Acceptance criteria

• Rulesets configured on master and develop via GitHub UI (or via gh api repos/.../rulesets)
• Direct push to master/develop fails for non-admins
• PRs with failing CI cannot be merged to either
• Back-merge PRs from gitflow-release.yml: tag + back-merge + invoke release on master merge (replaces tag.yml) #21 merge automatically without CI re-running
• CONTRIBUTING.md updated with a "Branch policy" section explaining the rules and the bot-bypass rationale

Blocked by

• Branch policy: ValidateBranchPolicy dagger fn + branch-policy.yml #15 (branch-policy check must exist)
• gitflow-release.yml: tag + back-merge + invoke release on master merge (replaces tag.yml) #21 (back-merge automation must exist)