Surface stable GitHub checks so branch protection can require CI

[hudsonaikins]

Problem

main is now protected against direct pushes, force pushes, deletions, and unresolved conversations, but we cannot yet require passing CI because the public PR surface does not expose stable GitHub-side checks consistently.

Scope

• audit which CI or commit status signals are reliably available on public PRs
• make at least one stable required check visible on pull requests
• tighten branch protection to require that check once it is dependable

Acceptance Criteria

• at least one required CI/check signal appears consistently on PRs
• branch protection is updated to require it
• maintainer docs explain the required-check policy

[hudsonaikins]

Addressed by PR #32 and merged into main. See #32 for the implementation details.