Require site quality checks before merging to main

[n30nex]

Summary

main currently requires a pull request and one code-owner approval, but it does not require the repository's quality checks or resolved review conversations before merge.

Current state

The GitHub branch-protection API reports:

• required status checks: not enabled
• required conversation resolution: disabled
• required code-owner reviews: enabled, one approval

The merged overhaul commit shows the three relevant Validate site quality jobs:

• validate
• browser
• lighthouse

The deployment workflow correctly waits for a successful quality run on a main push. That protects the live site from a failed build, but it does not protect main: a broken merge can land, fail validation, and leave production on the previous revision while the default branch is undeployable.

Expected result

Update branch protection (or an equivalent repository ruleset) so merges to main require:

• successful validate, browser, and lighthouse checks from Validate site quality
• resolved review conversations
• the existing pull-request/code-owner review requirement

Administrator bypass can remain an explicit break-glass policy if the maintainers need it; the normal merge path should still be guarded.

Acceptance checks

• A PR with any of the three quality jobs failing cannot merge through the normal path.
• A PR with an unresolved review conversation cannot merge through the normal path.
• The reviewed-site deployment still deploys the exact validated main revision.