fix(governance): add default branch ruleset

.github/rulesets/branch-main.json

@@ -0,0 +1,38 @@
+{
+  "name": "Protect main (signed commits)",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "required_signatures"},
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "required_reviewers": [],
+        "dismissal_restriction": {"enabled": false, "allowed_actors": []},
+        "allowed_merge_methods": ["merge", "squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [{"context": "Gate"}]
+      }
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -65,3 +65,19 @@ jobs:
           go-version: '1.25.x'
           cache: false
       - run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
+
+  gate:
+    name: Gate
+    if: always()
+    needs: [test, vulnerabilities]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every CI lane
+        env:
+          TEST: ${{ needs.test.result }}
+          VULNERABILITIES: ${{ needs.vulnerabilities.result }}
+        run: |
+          set -euo pipefail
+          test "${TEST}" = success
+          test "${VULNERABILITIES}" = success