feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

CODEOWNERS

@@ -0,0 +1,5 @@
+@perplexity
+@Timmy the-nexus/
+@Timmy hermes-agent/
+@perplexity timmy-config/
+@perplexity timmy-home/

GOVERNANCE.md

@@ -0,0 +1,31 @@
+# Nexus Repository Governance
+
+## Branch Protection Policy
+
+All repositories must have the following branch protections enabled for the `main` branch in Gitea:
+
+1. Require PR for merge
+2. Require 1 approval
+3. Dismiss stale approvals
+4. Require CI to pass (where applicable)
+5. Block force pushes
+6. Block branch deletion
+
+## Default Reviewers Assignments
+
+- All repositories: `@perplexity` (QA gate)
+- `hermes-agent`: `@Timmy` (owner gate)
+- Specialized areas: repo-specific owners
+
+## CI Requirements
+
+- CI must be enabled for:
+  - the-nexus (CI runner #915)
+  - hermes-agent
+- CI is optional for:
+  - timmy-config
+  - timmy-home
+
+## Compliance
+
+All changes must comply with these rules. See Gitea repo settings for branch protection configuration.