[Stage 0.4] Protect main and release/v1 with repository rulesets

[draedful]

Parent: #310

Goal

Protect both long-lived branches from bypassing their verification and review process.

Scope

Configure repository rulesets for main and release/v1 that:

• require changes to go through pull requests;
• require the agreed CI, test, E2E, and package-contract checks;
• require at least one approval;
• require review conversations to be resolved;
• prevent branch deletion and force pushes;
• preserve the required release automation through a narrowly scoped bypass, if necessary.

This task requires repository or organization admin permissions.

Acceptance criteria

• Both branch names are covered by active rulesets.
• Direct unreviewed changes are rejected.
• Required checks must pass before merge.
• Force pushes and branch deletion are blocked.
• Release automation has only the minimum bypass permission it needs.
• The effective rules and owners are documented.