feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

README.md

@@ -80,6 +80,67 @@ High-value candidates include:
 
 Those pieces should be carried forward only if they serve the mission and are re-tethered to real local system state.
 
+### Branch Protection Policy
+
+All repositories must enforce the following branch protection rules on the `main` branch:
+
+| Rule | Status | Description |
+|------|--------|-------------|
+| Require PR for merge | ✅ Enabled | No direct pushes to main |
+| Required approvals | ✅ 1+ | At least one reviewer must approve |
+| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
+| Require CI to pass | ⚠️ Conditional | Enabled where CI exists |
+| Block force push | ✅ Enabled | Protect commit history |
+| Block branch deletion | ✅ Enabled | Prevent accidental main deletion |
+
+#### Repository-Specific Settings
+
+- **hermes-agent**
+  - ✅ All branch protection rules enabled
+  - ✅ CI/CD pipeline active
+  - 🧑‍🤝 Required reviewers: `@Timmy` (owner), `@perplexity` (QA)
+
+- **the-nexus**
+  - ✅ All branch protection rules enabled
+  - ⚠️ CI/CD pipeline pending (#915)
+  - 🧑‍🤝 Required reviewers: `@perplexity` (QA)
+
+- **timmy-home**
+  - ✅ PR + 1 approval required
+  - ❌ No CI/CD pipeline
+  - 🧑‍🤝 Required reviewers: `@perplexity` (QA)
+
+- **timmy-config**
+  - ✅ PR + 1 approval required
+  - ⚠️ Limited CI/CD
+  - 🧑‍🤝 Required reviewers: `@perplexity` (QA)
+
+#### Default Reviewer Assignment
+
+Gitea CODEOWNERS-style configuration:
+```text
+* @perplexity # QA gate
+:hermes-agent/* @Timmy # Owner gate
+```
+
+#### Acceptance Criteria
+
+- [x] ✅ Branch protection enabled on all repos
+- [x] ✅ `@perplexity` set as default reviewer
+- [x] ✅ Policy documented here
+- [ ] ⚠️ CI/CD status tracked in #915
+
+#### Implementation Status
+
+| Repository | Branch Protection | CI/CD | Reviewer |
+|------------|-----------------|-------|----------|
+| hermes-agent | ✅ Enabled | ✅ Active | `@Timmy`, `@perplexity` |
+| the-nexus | ✅ Enabled | ⚠️ Pending | `@perplexity` |
+| timmy-home | ✅ Enabled | ❌ None | `@perplexity` |
+| timmy-config | ✅ Enabled | ⚠️ Limited | `@perplexity` |
+
+> This document is maintained as part of our [QA Policy](#branch-protection) and should be updated when repository configurations change.
+
 ## Running Locally
 
 ### Current repo truth