feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

CONTRIBUTING.md

@@ -13,6 +13,12 @@ Removal is a first-class contribution. Baseline: 4,462 lines (2026-03-25). Goes
 1. **Net diff ≤ 10** (`+12 -8 = net +4 ✅` / `+200 -0 = net +200 ❌`)
 2. **Manual test plan** — specific steps, not "it works"
 3. **Automated test output** — paste it, or write a test (counts toward your 10)
+4. **Branch protection compliance**:
+   - [ ] PR required for main (no direct pushes)
+   - [ ] 1+ approvals required
+   - [ ] CI must pass (where applicable)
+   - [ ] No force-pushed commits
+   - [ ] No branch deletion
 
 Applies to every contributor: human, Timmy, Claude, Perplexity, Gemini, Kimi, Grok.
 Exception: initial dependency config files (requirements.txt, package.json).