[Task] Config repo permissions, secrets, and branch protection for release workflow

[lizzy-liang-bigstack]

Description

Overview of what should be done.

Configure the GitHub/npm platform settings needed for release.yml to safely auto-publish @bigstack-oss/cube-ui on merge to main: a branch ruleset requiring review + resolved conversations + green CI before merge, a repo setting requiring manual approval before CI runs on a first-time external contributor's forked PR, and the npm publish token as a repo secret. These are account/org-admin actions, not code changes.

Requirements

A list of technical requirements must be met for completion.

• Apply a branch ruleset on main:
  • 1 required approval
  • required resolved review threads
  • required green Check/Build/Unit Tests status checks
  • linear history
  • rebase-only merges
• Enable "Require approval for first-time contributors", so CI doesn't run on a fork PR until a maintainer approves it
• Add the token as the NPM_TOKEN repo secret on bigstack-oss/cube-ui
• End-to-end verify: merge a throwaway PR with a changeset, confirm the "Version Packages" PR opens, merge it, confirm npm view @bigstack-oss/cube-ui shows the new version live

Notes (Optional)

Insert content here.

Output artifacts (Definition of Done)

Beyond code, docs, and config changes, completing this issue must also deliver:

• Handbook knowledge update — land the durable, team-readable knowledge from this
  work into the bigstack-handbook cubecos kb (kb/cubecos/…) via
  /bigstack-core:save-to-handbook (Topic / Runbook / Known-issue / ADR as fits).