feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitea.yml

@@ -8,8 +8,13 @@ protection:
     allow_deletions: false
     require_pull_request: true
     require_status_checks: true
+    required_status_checks:
+      - "ci/unit-tests"
+      - "ci/integration"
     reviewers:
       - perplexity
+    required_reviewers:
+      - Timmy # Owner gate for hermes-agent
 main:
   require_pull_request: true
   required_approvals: 1

CONTRIBUTING.md

@@ -253,16 +253,18 @@ All repositories must have the following branch protection rules enabled on the
 
 ## Branch Protection & Review Policy
 
-All repositories must enforce these rules on the `main` branch:
+See [POLICY.md](POLICY.md) for full branch protection rules and review requirements. All repositories must enforce:
 
-| Rule | Status | Rationale |
-|---|---|---|
-| Require PR for merge | ✅ Enabled | Prevent direct commits |
-| Required approvals | ✅ 1+ | Minimum review threshold |
-| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
-| Require CI to pass | ⚠ Conditional | Only where CI exists |
-| Block force push | ✅ Enabled | Protect commit history |
-| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
+- Require Pull Request for merge
+- 1+ required approvals
+- Dismiss stale approvals
+- Require CI to pass (where CI exists)
+- Block force push
+- Block branch deletion
+
+Default reviewers:
+- @perplexity (all repositories)
+- @Timmy (hermes-agent only)
 
 ### Repository-Specific Configuration