Branch Rules

Protect main: require PR reviews, passing checks, and linear history. It stops accidental force-pushes and keeps the log readable.