feat(security): add branch protection rules

[wendev27]

🛡️ Summary

Configured branch protection rules for the main branch.

Changes

• Required pull requests before merging
• Added required status checks:
  • Node CI
  • CodeQL
• Blocked force pushes
• Restricted branch deletion
• Required pull request approvals
• Required conversation resolution

Purpose

This configuration prevents unreviewed or insecure code from being merged into the protected branch and enforces CI/CD security gates.

[wendev27]

🎯 Branch Protection Test Completed

This pull request was used to validate the branch protection and CI/CD security gates configured for the main branch.

Experiments performed

• Intentionally broke the test suite to trigger a CI failure.
• Verified that pull requests cannot be merged when required checks fail.
• Added pull_request triggers to the Node CI workflow.
• Integrated Trivy container scanning into the pipeline.
• Relaxed the Trivy policy after validating the security gate behavior.
• Confirmed that CodeQL and GitHub Actions work with branch protection rules.

Key Takeaways

• CI workflows alone do not prevent merges.
• Branch protection rules enforce security policies.
• Trivy can block deployments when configured with exit-code: 1.
• GitHub Actions, CodeQL, and Trivy together create a secure CI/CD pipeline.

✅ Experiment completed successfully.