Now that each fork's Woodpecker image build is green, lock down main:
Owners-only merge, PRs must pass the build check, and the owner may push
main directly for upstream-fix maintenance merges.
- add branch_protection(main) to sonarr/radarr/prowlarr.yaml
- required check: ci/woodpecker/pr/docker; merge whitelist: Owners; push whitelist: unkinben