docs: govern protected master

[kabudu]

Summary

• record the newly active master branch-protection policy
• require PRs, strict up-to-date portable CI, resolved conversations, and linear history
• document disabled force pushes and deletion
• constrain the administrator bypass to the existing privacy-safe noreply squash procedure
• remove stale private-repository CI wording from the contributor guide
• complete Post-M68

Effective GitHub policy

• pull requests: required; stale approvals dismissed; approval count 0
• status check: strict portable, bound to GitHub Actions app 15368
• conversations: resolved
• linear history: required
• force pushes/deletion: disabled
• administrator enforcement: disabled only for privacy-safe local squash

Acceptance evidence

• branch-protection API verified every setting above
• python3 scripts/validate-project.py — passed
• python3 scripts/validate-open-source-readiness.py — passed
• ./scripts/ci-local.sh — passed before commit

[kabudu]

Reviewed head 009abf9b7e6e534498e5ba5e075d4b42e9a03292 passed:

• full local ./scripts/ci-local.sh before commit
• required hosted portable run 31326763048
• branch protection moved the PR from BLOCKED to CLEAN only after that check passed
• full local ./scripts/ci-local.sh again at the exact reviewed head
• complete remote diff inspected; no review threads

Proceeding through the documented administrator bypass solely to create the privacy-safe noreply squash commit.

[kabudu]

Merged by the documented privacy-safe administrator bypass using a local noreply squash commit after all protected-branch, local CI, hosted CI, and review gates passed.