Release governance: activate and verify main branch protection ruleset #322

Release governance — administrator action required

Verified on 2026-10-24: GitHub REST GET /repos/masarray/arstack61850/rulesets returned [] even though the repository contains a proposed ruleset file. Reading branch protection returned HTTP 403 Resource not accessible by integration. Therefore code/CI alone does not prove main is protected.

The immutable M3.H Public Stable Release is already published and source/tag ancestry is in main. Do not modify M3.H firmware or original five release assets for this task.

Apply with authorized administrator credentials

Follow docs/MAINTAINER_MAIN_PROTECTION.md:

bash scripts/apply_main_ruleset.sh --dry-run
bash scripts/apply_main_ruleset.sh --apply

Alternatively: Settings → Rules → Rulesets and import the equivalent of .github/rulesets/main-protection.json.

Acceptance (verify, don't infer)

• An active ARStack Main - Pull Requests and Naming CI ruleset targets refs/heads/main.
• Main deletion and force push are prohibited.
• Direct changes to main require a PR, with review threads resolved.
• Required CI check tracked-tree-names must PASS at up-to-date base before merge.
• Capture the live ruleset ID and settings link or API response as closure evidence; no bypass test should be performed against working main.
• Close this issue only after GitHub confirms active enforcement.

Scope: administrative release-quality guard only; does not block the already published tested M3.H laboratory product, nor represent external PTP/IED hardware acceptance.