chore: verify and configure branch protection rules for main and dev

[digital-michael]

Goal

Ensure main and dev are protected against direct pushes and force-pushes before any code work begins.

Acceptance criteria

• main: require PR + 1 approval, require status checks to pass, no direct push, no force push
• dev: require PR, require status checks to pass, no direct push, no force push
• Confirmed in repo Settings → Branches

Notes

Branch protection was previously set up on main during initial setup. Verify the full ruleset is correct and extend it to dev.