ci: enforce required checks and two-person promotion on dev and main

[m-khan-97]

What is wrong

The documented process says CI and approval are required before merge. The GitHub branch API currently reports both dev and main as protected, but required status-check enforcement is off with no required checks/contexts. Repository rulesets are empty.

The current token cannot inspect classic approval settings, so those must be verified by an administrator rather than assumed.

Evidence: live branch API checked 2026-08-21; documentation at docs/ci-pipeline.md:143-154.

Required work

• Export and review the effective protection/ruleset configuration for both branches.
• Require PRs, strict/up-to-date status checks and conversation resolution.
• Require the stable CI Summary plus CodeQL, DCO and dependency/security gates selected by the maintainers.
• Require code-owner review and two-person review for main promotion and all auth/scoring/compliance/infra changes.
• Restrict and audit admin bypass; define emergency procedure.
• Run post-merge or merge-queue CI, not PR-only assurance.
• Keep GitHub documentation generated/aligned with effective settings.

Acceptance criteria

• A deliberately failing required check prevents merge on both branches.
• A stale head cannot merge when strict mode is required.
• Main promotion cannot be self-approved by its author.
• An exported configuration or automated assertion is retained as evidence.
• The documented feature → dev → main process matches effective GitHub behavior.