Enable branch protection + auto-merge on main (require deterministic checks only)

## Goal

Make `gh pr merge --auto` genuinely gate on CI ("merge when green") by protecting `main` with required status checks and enabling repo auto-merge. Currently `main` is unprotected and `allow_auto_merge` is off, so `--auto` merges immediately.

## Context

While shipping #90/#91/#92 the branch merged before CI confirmed green (no required checks). We want future merges to wait for the deterministic checks. The live-cloud provisioning smokes (`aws`/`hetzner`/`incus`) are inherently flaky and must stay **advisory**, not required.

The required list below was verified to come only from workflows that run on **every** PR to `main` with **no path filters** (`ci.yml`, `codeql.yml`, `dependency-review.yml`), so none can deadlock a PR with "Expected — waiting for status".

## Commands (needs repo admin)

```bash
# 1) Enable auto-merge so `gh pr merge --auto` queues until checks pass
gh api repos/get2knowio/remo -X PATCH -F allow_auto_merge=true

# 2) Require only the deterministic checks on main; smokes stay advisory
gh api -X PUT repos/get2knowio/remo/branches/main/protection --input - <<'JSON'
{
"required_status_checks": {
"strict": false,
"contexts": [
"Tests (Python 3.11)",
"Tests (Python 3.12)",
"Tests (Python 3.13)",
"Lint",
"Analyze (python)",
"Analyze (javascript-typescript)",
"Frontend (typecheck + unit + build)",
"Docker image (amd64 + arm64)",
"Wheel install smoke test",
"dependency-review"
]
},
"enforce_admins": false,
"required_pull_request_reviews": null,
"restrictions": null
}
JSON
```

## Decisions to confirm before applying

- **`enforce_admins: false`** — admins can still override in a pinch (won't lock you out). Set `true` to apply the gate to admins too.
- **`strict: false`** — PRs need not be rebased onto latest `main` before merge (less friction). Set `true` to require checks ran against the freshest `main`.
- **No required reviews** — matches the current solo-merge flow. Add `required_pull_request_reviews` if mandatory review is wanted later.

## Notes

- The live-cloud smokes (`aws`/`hetzner`/`incus`) are deliberately excluded from required checks; keep them advisory.
- Automation could not apply these (repo-settings mutations blocked by the assistant's auto-mode guardrail), so this needs a manual run by a repo admin.

Start by reviewing ci.yml, codeql.yml, and dependency-review.yml to confirm the listed checks run on every PR to main without path filters. A repo admin should then run the two gh api commands, preserving the stated decisions and keeping aws/hetzner/incus smoke checks advisory. Done means auto-merge is enabled and main requires only the deterministic checks.

Written by the indexing model from the issue text.