feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

nexus/.gitea/main-branch-protection.yml

@@ -0,0 +1,25 @@
+branch: main
+protection:
+  required_pull_request_reviews:
+    required_approving_review_count: 1 
+    dismiss_stale_reviews: true
+    require_code_owner_reviews: true
+    required_reviewers:
+      - perplexity
+      - Timmy
+  required_status_checks:
+    strict: true
+    contexts:
+      - ci/test
+      - ci/lint
+      - ci/build
+  enforce_admins: true
+  restrictions:
+    team_whitelist:
+      - perplexity
+      - Timmy
+    block_force_pushes: true
+    block_deletions: true
+  required_linear_history: true
+  required_signatures: false
+  required_conversation_resolution: true

nexus/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# CODEOWNERS - Default reviewers for branch protection
+
+* @perplexity
+/docs @Timmy
+/src/hermes @Timmy
+/test @perplexity
+/config @Timmy