Branch protection on release/v11 (and future release/vN)

[ChrisonSimtian]

Sibling of milestone #13. RFC #267.

What

Apply branch protection to release/v11 (and document the policy so future release/vN get the same treatment when cut).

Acceptance criteria

• Required status checks: ubuntu-latest (matching main's gate).
• Linear history required (matches the main rebase/squash-only policy).
• CODEOWNER review required on PRs targeting release/v11.
• Direct pushes blocked (except by maintainers using the established release-tagger account, if applicable).
• Tag protection: v* tags can only be created by maintainers (limits who can fire a release).
• Policy documented in docs/agents/release-and-versioning.md (or wherever the branching docs live) so the same settings get applied when release/v12 is cut later.

Depends on

• release/v11 exists.

[ChrisonSimtian]

Done. Both halves of #270 landed (PR #278 just merged):

1. Branch protection on release/v11 — applied via API with a profile mirroring main (required ubuntu-latest, linear history, CODEOWNER reviews, force-push and deletion blocked, conversation resolution required, admins can bypass).
2. Policy documented in docs/agents/release-and-versioning.md — new "Branch protection on release/vN" subsection so future release/v12/etc. cuts mirror the same settings.

Scope note

The tag-protection bullet from this issue's original acceptance criteria has been folded into #274 (comment) — release.yml refactor and tag protection are paired concerns and belong in the same PR.

What's unblocked next

• #272 — Create three GitHub Environments (independent, can start now)
• #274 — release.yml refactor + tag protection (still gated on Create three GitHub Environments: nuget-org, github-packages, github-releases #272 / Move NUGET_API_KEY from repo secret to nuget-org environment secret #273)