Set up branch protection/ruleset for main

[ClickSentinel]

Summary

Create and enable a branch ruleset for main so merges are consistently gated by PR review and CI checks.

Why

We now have higher-impact installer and release-path changes landing via PR (for example #6). main should be protected to reduce accidental direct pushes and ensure checks pass before merge.

Proposed ruleset

• Target branch: main
• Enforcement: Active (or Evaluate briefly, then Active)
• Require pull request before merge
• Require at least 1 approval
• Require conversation resolution before merge
• Require status checks to pass before merge
• Block force pushes
• Block branch deletion
• Optional: require branch to be up to date before merge

Suggested required checks

Use exact check names from recent runs:

• CI / installer-defaults
• CI / extension
• CI / native-host
• Any additional Windows artifact/release validation checks you decide are PR-blocking

Bypass policy

• Keep bypass list minimal (owner/admin only for emergencies)

Acceptance criteria

• Ruleset exists and targets main
• Ruleset is enabled (Active)
• PR + approval + conversation resolution required
• Required checks are configured and verified on a test PR
• Force-push and branch deletion are blocked on main

[ClickSentinel]

Completed. Branch protection is enabled.