release(ci): require passing checks before main merges

[NikolayS]

Severity

High — repository-level release integrity.

Problem

The active protect-main repository ruleset targets the default branch and requires pull requests plus resolved review threads, but it has no required_status_checks rule. Its required approving review count is also zero.

Observed on 2026-07-10:

• ruleset: protect-main (active, default branch)
• rules: deletion protection, non-fast-forward protection, pull request
• pull-request rule: resolved review threads required; approving reviews 0
• required status checks: none
• classic branch protection endpoint: not configured (the ruleset is the only protection mechanism)

As a result, a PR can be merged to main while release-critical CI is pending or failing. The 0.3 work includes PostgreSQL 14–18 plus 19 beta, pg_tle, pg_cron, upgrade, acceptance, and four client matrices; relying on manual inspection for all of them is too fragile.

Required before 0.3.0

• Add a required-status-checks rule to protect-main for the stable, release-critical CI contexts.
• Require the branch to be up to date before merge, or document an equivalent merge-queue policy.
• Require at least one approval for release/final-promotion PRs (globally or through a release-specific rule).
• Confirm a deliberately failing test PR cannot merge and a fully green PR can.
• Keep the current required review-thread resolution rule.

This is external repository configuration and cannot be completed by a code-only PR.