main has branch protection matching the trunk-based + squash-merge flow

## User story

As a **maintainer**, I want **`main` to have branch protection that matches our trunk-based flow** so that **accidental direct pushes and unreviewed bot commits cannot land, and every PR goes through the same gate**.

## Why

Trunk-based development assumes `main` is sacred. Without protection, a force-push or a rogue bot merge can break the release-please state and tags. The rules below match the trunk + squash-merge + release-please flow.

## Acceptance criteria

- [ ] Branch protection rule on `main` with:
- Require a pull request before merging: on.
- Require approvals: 1 (maintainer can approve own PRs via ruleset, or bypass as owner — pick one and document).
- Require review from Code Owners: on (after CODEOWNERS issue lands).
- Require status checks to pass: on. Required checks include `pre-commit`, `pytest (3.x)` matrix jobs, `scripts (3.x)` matrix jobs, `build`, `conventional-pr-title`, `CodeQL`.
- Require branches to be up to date before merging: on.
- Require conversation resolution before merging: on.
- Require linear history: on (matches squash-merge).
- Do not allow force pushes: on.
- Do not allow deletions: on.
- [ ] Allowed merge types on the repo: squash only. Disable merge-commit and rebase-merge.
- [ ] Auto-merge is enabled repo-wide so Renovate PRs can self-merge when green.

## Out of scope

- Rulesets for other branches (none are long-lived).

## Notes

- Target release: **none — chore**
- Depends on: branch rename (`main`), CODEOWNERS, Conventional Commits CI check, CI consolidation.
- Source: branch-strategy discussion, modernization assessment §4.