feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

README.md

@@ -99,3 +99,28 @@ The browser-facing Nexus must be rebuilt deliberately through the migration back
 ---
 
 *One 3D repo. One migration path. No more ghost worlds.*
+## Branch Protection Policy
+
+We enforce the following rules on all repositories:
+
+### Mandatory for All Repos
+- ✅ Pull Request Required for Merge
+- ✅ Minimum 1 Approval Required
+- ⚠️ Dismiss Stale Approvals
+- 🔒 Block Force-pushing to Main
+- 🚫 Block Branch Deletion
+
+### CI Requirements
+- ✅ CI Must Pass to Merge (where CI exists)
+
+### Default Reviewers Assignments
+- 🤖 @perplexity - All repositories (QA gate)
+- 🤖 @Timmy - hermes-agent (owner gate)
+
+### Implementation Status
+- [r] hermes-agent
+- [x] the-nexus
+- [x] timmy-home
+- [x] timmy-config
+
+See Gitea branch settings for full policy details.