feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

nexus/.gitea/branch-protection.yml

@@ -0,0 +1,13 @@
+main:
+  required_pull_request_reviews:
+    required_approving_review_count: 1
+    dismiss_stale_reviews: true
+    require_code_owner_reviews: false
+  required_status_checks:
+    strict: true
+    contexts:
+      - "ci/ci"
+  enforce_admins: true
+  required_linear_history: false
+  allow_force_pushes: false
+  allow_deletions: false

nexus/CODEOWNERS

@@ -0,0 +1,2 @@
+* @perplexity
+/the-nexus @Timmy