docs: define default branch check policy

README.md

@@ -13,6 +13,24 @@ Renovate uses the shared organization preset and tracks the four scanner image
 tags and digests in `scan.yml`. Digest-only updates remain manual under that
 preset. Image tags provide update metadata; execution remains pinned by digest.
 
+## Default-branch checks
+
+Repositories ready for immediate GitHub-native Renovate automerge opt in with
+`platformAutomerge: true` and an active `default-branch-checks` ruleset. The
+[shared preset](https://github.com/uinaf/renovate-config) keeps this opt-in off
+by default. Update eligibility and release age remain preset-owned.
+
+Required checks constrain every update to the default branch, including direct
+pushes. Approved content and release writers need repository-specific exceptions
+to the checks ruleset. Signing, deletion, and force-push protections remain in
+the separate organization baseline. An App's repository access alone does not
+authorize an exception.
+
+Before changing a rule, compare its checks and exceptions with the owning
+workflow or publishing contract. Preserve a before-state and review the exact
+change; verify live rules after a canary and after the rollout. Keep fleet
+inventories that include private repositories in a private repository.
+
 ## Verify
 
 Run changed workflow checks locally with `mise run verify`. Before handoff, run