feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

README.md

@@ -68,9 +68,26 @@ still contains the old root browser files (`index.html`, `app.js`, `style.css`,
 - `#674` reflex tactical layer and semantic trajectory logging
 - `#675` deterministic context compaction for long local sessions
 
-## What gets preserved from legacy Matrix
+## Branch Protection Policy
 
-High-value candidates include:
+**All repositories under Timmy_Foundation must enforce these rules on the `main` branch:**
+
+### Required Protections
+- ✅ Pull Request required for merge
+- ✅ 1+ approved reviewer (including @perplexity)
+- ✅ Stale approvals auto-dismiss on new commits
+- ⚠️ CI status checks (where CI exists)
+- ❌ Force push protection
+- ❌ Branch deletion protection
+
+**CODEOWNERS:**
+- @perplexity (all repos)
+- @Timmy (hermes-agent)
+- @Rockachopa (repo-specific areas)
+
+> Blocks direct commits to main, unreviewed merges, and ensures all changes go through formal PR process.
+
+## What gets preserved from legacy Matrix
 - visitor movement / embodiment
 - chat, bark, and presence systems
 - transcript logging