ci: enforce required checks and two-person promotion on dev and main

What is wrong

The documented process says CI and approval are required before merge. The GitHub branch API currently reports both dev and main as protected, but required status-check enforcement is off with no required checks/contexts. Repository rulesets are empty.

The current token cannot inspect classic approval settings, so those must be verified by an administrator rather than assumed.

Evidence: live branch API checked 2026-08-21; documentation at docs/ci-pipeline.md:143-154.

Required work

• Export and review the effective protection/ruleset configuration for both branches.
• Require PRs, strict/up-to-date status checks and conversation resolution.
• Require the stable CI Summary plus CodeQL, DCO and dependency/security gates selected by the maintainers.
• Require code-owner review and two-person review for main promotion and all auth/scoring/compliance/infra changes.
• Restrict and audit admin bypass; define emergency procedure.
• Run post-merge or merge-queue CI, not PR-only assurance.
• Keep GitHub documentation generated/aligned with effective settings.

Acceptance criteria

• A deliberately failing required check prevents merge on both branches.
• A stale head cannot merge when strict mode is required.
• Main promotion cannot be self-approved by its author.
• An exported configuration or automated assertion is retained as evidence.
• The documented feature → dev → main process matches effective GitHub behavior.

Start with docs/ci-pipeline.md:143-154 and inspect the effective GitHub branch protection and ruleset configuration for dev and main, with an administrator verifying classic approval settings. Done means the required checks, two-person promotion, bypass controls, post-merge or merge-queue CI, and documented feature → dev → main process are aligned, with an exported configuration or automated assertion retained as evidence.