feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitea/branch-protection.yml

@@ -0,0 +1,36 @@
+repos:
+  hermes-agent:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: true
+      block_force_push: true
+      block_deletion: true
+
+  the-nexus:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # CI runner dead per #915
+      block_force_push: true
+      block_deletion: true
+
+  timmy-home:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # No CI configured
+      block_force_push: true
+      block_deletion: true
+
+  timmy-config:
+    branch_protection:
+      require_pull_request: true
+      required_approvals: 1
+      dismiss_stale_reviews: true
+      require_ci_to_pass: false # Limited CI
+      block_force_push: true
+      block_deletion: true