chore: add pre-commit hook to block direct pushes to main

Problem

AI-assisted sessions occasionally push commits directly to main instead of creating a feature branch first. This bypasses code review and can introduce unreviewed changes to production pipelines.

Proposed fix

Add a pre-commit hook that blocks direct pushes to main.

.pre-commit-config.yaml in repo root:

repos:
  - repo: local
    hooks:
      - id: no-direct-main-push
        name: Block direct push to main
        entry: bash -c 'branch=$(git rev-parse --abbrev-ref HEAD); if [ "$branch" = "main" ]; then echo "ERROR: Direct push to main is blocked. Create a feature branch and open a PR."; exit 1; fi'
        language: system
        stages: [pre-push]

One-time setup per clone:

pip install pre-commit
pre-commit install --hook-type pre-push

This should also be documented in the repo README setup section.

Notes

• pre-commit is already a standard tool in data engineering repos
• The hook is bypassable with --no-verify (intentional escape hatch for genuine emergencies)
• Branch protection rules would be the stronger fix but require a paid GitHub plan

Start with the proposed .pre-commit-config.yaml entry and the repository README setup section. Install pre-commit and test the hook from main and a feature branch. Done means pushes from main are blocked with the stated message, feature-branch pushes work, and the README documents the one-time setup.