Fix Marketplace publisher and protect main

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Azayzel

.github/workflows/release.yml

@@ -74,7 +74,7 @@ jobs:
         if: steps.version.outputs.released != 'true'
         run: |
           unzip -p dist/comparelab.vsix extension/package.json |
-            node -e 'const fs = require("node:fs"); const assert = require("node:assert/strict"); const manifest = JSON.parse(fs.readFileSync(0, "utf8")); assert.equal(manifest.version, process.env.RELEASE_VERSION); assert.equal(manifest.publisher, "azayzel"); assert.equal(manifest.name, "comparelab");'
+            node -e 'const fs = require("node:fs"); const assert = require("node:assert/strict"); const expected = require("./package.json"); const manifest = JSON.parse(fs.readFileSync(0, "utf8")); assert.equal(manifest.version, process.env.RELEASE_VERSION); assert.equal(manifest.publisher, expected.publisher); assert.equal(manifest.name, expected.name);'
           if [ "$RESUMING" = "true" ]; then
             echo "Resuming the saved artifact; an already-published version is accepted."
             npm exec -- vsce publish --packagePath dist/comparelab.vsix --oidc --skip-duplicate

CONTRIBUTING.md

@@ -36,7 +36,7 @@ The `.vscodeignore` allowlist includes only the manifest, README, license, runti
 
 ### One-time maintainer setup
 
-1. Create or obtain access to the **azayzel** publisher at [Marketplace publisher management](https://marketplace.visualstudio.com/manage). The extension identity is `azayzel.comparelab`.
+1. Create or obtain access to the **azayzel-comparelab** publisher at [Marketplace publisher management](https://marketplace.visualstudio.com/manage). Use the Publisher ID, not its display name or your GitHub username. The extension identity is `azayzel-comparelab.comparelab`.
 2. Create a GitHub environment named **marketplace** in this repository. Restrict its deployment branches to **main**. Add reviewers only if you want a manual approval before each release.
 3. In the publisher's **Trusted Publishing** settings, create a policy with these exact values:
    - Repository owner: `Azayzel`
@@ -91,4 +91,11 @@ Marketplace icons must be PNG, so [media/comparelab-icon.png](media/comparelab-i
 
 ## Pull requests
 
+`main` is protected by two active GitHub rulesets:
+
+- **Main - required tests** requires the GitHub Actions `test` check to pass against an up-to-date base, blocks force pushes and deletion, and has no bypass actors, including the owner.
+- **Main - pull request review** requires a PR and one code-owner approval, with stale approvals dismissed after new pushes. [CODEOWNERS](.github/CODEOWNERS) assigns all files to `@Azayzel`.
+
+Only `@Azayzel` may bypass the review ruleset when merging a PR, allowing owner-authored PRs without a second reviewer. This is a merger-based exemption, not an author-based one: the owner can also explicitly bypass review on another contributor's PR. It never bypasses required tests or permits direct pushes.
+
 Describe what changed, which tests passed, and whether you performed live provider or VS Code interaction tests. Provide sanitized screenshots for UI changes. Do not include real secrets or proprietary model prompts in issues, fixtures, or logs.

README.md

@@ -84,7 +84,7 @@ See [CONTRIBUTING](CONTRIBUTING.md) for the development workflow.
 ## Releases
 
 After [publishing setup](CONTRIBUTING.md#automated-releases), each merge to `main`
-bumps the release patch version and publishes to the [Marketplace](https://marketplace.visualstudio.com/items?itemName=azayzel.comparelab)
+bumps the release patch version and publishes to the [Marketplace](https://marketplace.visualstudio.com/items?itemName=azayzel-comparelab.comparelab)
 and [GitHub Releases](https://github.com/Azayzel/CompareLab/releases). Nothing publishes from pull requests.
 
 ## Documentation

package.json

@@ -4,7 +4,7 @@
   "icon": "media/comparelab-icon.png",
   "description": "Compare AI models and prompt variants in VS Code with inline diffs, controlled evaluations, and local-first Ollama/OpenAI-compatible runners.",
   "version": "0.2.0",
-  "publisher": "azayzel",
+  "publisher": "azayzel-comparelab",
   "private": false,
   "license": "MIT",
   "repository": {