chore: enforce main branch quality gate

[tim8es]

Current state

MindRail is public and GitHub Free rulesets are available. The permanent Quality workflow is healthy.

Observed required check on the current PR head:

• check name: quality
• GitHub App/source: GitHub Actions
• reconciliation run 33224006475: SUCCESS

The GitHub connector used by the maintainer's automation can read rulesets but does not expose create/update ruleset writes, so this repository-level control requires a one-time GitHub Settings action.

Required ruleset

Create an Active branch ruleset targeting the default branch (main) with:

1. Require a pull request before merging.
   • Do not require approving reviewers yet; MindRail currently has one maintainer.
2. Require status checks to pass before merging.
   • Required check: quality.
   • Expected source: GitHub Actions if GitHub offers the source selector.
   • Leave “Require branches to be up to date before merging” disabled initially to avoid duplicate CI runs for a single-maintainer repository; revisit when concurrent contribution volume justifies strict mode.
3. Block force pushes.
4. Restrict deletions / prevent deletion of the targeted branch.
5. Require conversation resolution before merging if that rule is offered in the current UI.
6. No broad bypass actors. Add an admin bypass only if a deliberate recovery path is needed.

GitHub UI path: Settings → Rules → Rulesets → New ruleset → New branch ruleset.

Verification after creation

• API /repos/tim8es/mindRail/rulesets returns the active ruleset.
• A test PR with a deliberately failing or missing quality check cannot merge.
• A green PR can merge through the normal PR path.
• docs/CURRENT_STATE.md and .github/PUBLIC_RELEASE_CHECKLIST.md are reconciled with observed enforcement.

Done when

The ruleset is active and the blocking behavior is demonstrated, not merely configured.