ci(gates): protect main with quality gates

[IvanLi-CN]

Summary

• Add .github/quality-gates.json as the repo-local source of truth for protected main gates.
• Stabilize the required GitHub Actions context as Build and add merge_group support.
• Convert release automation away from direct main writes; version updates must land as signed PRs before publishing.
• Document the quality-gate spec and maintainer-facing policy.

Verification

• python3 -m json.tool .github/quality-gates.json
• python3 /Users/ivan/.style-playbook-skills/skills/style-topic-quality-gates/scripts/check_quality_gates.py --repo-root . --declaration .github/quality-gates.json --allow-unchecked-branch-protection
• python3 YAML parse for .github/workflows/*.yml
• git diff --check
• cargo fmt -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test

References

• Specs: docs/specs/b7k2m-repo-quality-gates/SPEC.md
• Solutions: -
• Project Docs: README.md, .github/quality-gates.json

Notes

This fixes the root cause that allowed PR #1 to merge: GitHub had no branch protection on main and no repository rulesets.