db62cd1b26
Now that the source fork is seeded on main with the pinned upstream tree and a pristine upstream ref, enable branch protection on main: block direct pushes and require an Owners approval so future changes land through reviewed pull requests.