Protect main and require the CI check before merge

The branch-protection endpoint reports `main` as unprotected, and the repository has no rulesets. CI is healthy and runs on pull requests, but nothing at the repository layer requires `build / purity / test` to finish successfully before a merge or blocks a direct push from bypassing it.

Could we protect `main` with the `build / purity / test` status check required, require pull requests, dismiss stale approvals where appropriate, and restrict force pushes/deletion? The scheduled mutation job should remain advisory unless maintainers want its runtime on every merge; the required CI job already covers `verify:corpus`, build, purity, profile claims, CodeRabbit drift, imports, citation pins, and tests.

This directly extends risk-register entry `R-35`, where a PR merged while a blocking gate was still running and stranded its follow-up fix. Repository enforcement would make the existing gate authoritative rather than convention-only.

Verified through the branch-protection and rulesets APIs against `origin/main@1948c0e84e9e1e0238c191eb9703e20c07fe601a` on 2026-08-22.

Start with the branch-protection and rulesets API results for origin/main@1948c0e84e9e1e0238c191eb9703e20c07fe601a. Review how the repository currently exposes protection settings, then configure the requested pull-request, required-status-check, stale-approval, force-push, and deletion restrictions while leaving the scheduled mutation job advisory. Done means the API reports main as protected and requires build / purity / test before merge.

Written by the indexing model from the issue text.