docs(security): document and verify branch-protection ruleset for default branch

[WilliamBerryiii]

Summary

Codify and document the GitHub branch-protection ruleset on the default branch so reviewers, auditors, and the OpenSSF Scorecard Branch-Protection check can verify it without admin access.

Background

The repo already enforces signed tags and runs CodeQL, Gitleaks, Scorecard, and lint workflows on PRs. The current branch-protection configuration is not exported or documented, which limits external verifiability and creates drift risk.

Acceptance Criteria

• Default-branch ruleset enforces: required pull-request reviews (>=1, dismiss stale reviews on push), required status checks (CodeQL, Gitleaks, Scorecard, markdown/yaml/python lint, build), required signed commits, restrict force-push, restrict branch deletion, require linear history
• Ruleset JSON exported and committed to docs/security/branch-protection.md with a brief operator runbook
• SECURITY.md links to the exported ruleset
• Verification step (manual or scripted) documented for confirming live config matches the committed JSON
• OpenSSF Scorecard Branch-Protection check reaches its maximum score

Related

• Builds on Add hve-core release pipeline with dependency SBOM, signing artifacts, and Scorecard fixes #419 (release pipeline hardening)