feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

README.md

@@ -57,6 +57,31 @@ The commit the user pointed at:
 
 still contains the old root browser files (`index.html`, `app.js`, `style.css`, `package.json`, tests/), so it is a useful in-repo reference point for what existed before the later deletions.
 
+## Branch Protection & Review Policy
+
+### Enforced Rules
+
+All repositories under `Timmy_Foundation` enforce these protections on `main`:
+- ✅ Require PR for merge
+- ✅ 1+ approved reviewer
+- ✅ CI/CD must pass
+- ✅ No force pushes
+- ✅ No branch deletion
+
+### Default Reviewers
+| Repo | Required Reviewers |
+|---|---|
+| `hermes-agent` | `@Timmy` (owner), `@perplexity` (QA) |
+| `the-nexus` | `@perplexity` (QA), `@Rockachopa` (arch) |
+| `timmy-home` | `@perplexity` (QA) |
+| `timmy-config` | `@perplexity` (QA) |
+
+### CI Status
+- ✅ `hermes-agent` - protected
+- ⚠️ `the-nexus` - pending CI restoration (#915)
+- ✅ `timmy-home` - no CI
+- ✅ `timmy-config` - no CI
+
 ## Active migration backlog
 
 - `#684` sync docs to repo truth