waitfordb: add branch protection on main

Owners-only merge, benvin approval, and the required Woodpecker PR check.
Requires the repo to be activated in Woodpecker so ci/woodpecker/pr/build
reports before a PR can merge.

config/git.unkin.net/unkin/repository/waitfordb.yaml

@@ -3,7 +3,12 @@ private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
-# branch_protection is intentionally omitted on creation: the required Woodpecker
-# status checks do not exist until the repo is created and its first pipeline
-# runs, so requiring them up front would block the very first PR. Add protection
-# in a follow-up PR (mirroring node-lookup.yaml) once CI is green.
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"