Protect default branches of unprotected active repos

Why:
- An audit for the new unkin-agent bot (org-wide write) found repos with
  no branch_protection at all, so the agent (or anyone with write) could
  push straight to their default branch.
- The rest of the estate protects default branches; these repos were the gap.

How:
- Add enable_push: false + approval_whitelist_teams: Owners on each active
  repo's default branch, matching the estate's most common convention
  (PR-only; Owners can still open and approve).
- Omit status checks on these repos as none run CI, so a required context
  would permanently block merges.
- Leave the 8 archived repos untouched: they are read-only, nothing can push
  to them, and branch-protection creation on archived repos is rejected.

config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml

@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml

@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/benvin-utils.yaml

@@ -2,3 +2,8 @@ description: "Monorepo of small single-purpose CLI tools sharing a common librar
 private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/container-devcompute.yaml

@@ -1,3 +1,8 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/docker-template.yaml

@@ -3,3 +3,8 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/initbuilder.yaml

@@ -1,3 +1,8 @@
 description: "A repository for building initrd.img in docker "
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/puppetapi.yaml

@@ -2,3 +2,8 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml

@@ -2,3 +2,8 @@ description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/streamstack.yaml

@@ -1,3 +1,8 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"