[governance] Document main branch ruleset evidence

[aisamuraiagent-source]

Summary

Adds an audit-ready governance evidence document for the manually configured main branch ruleset.

Why this matters

GitHub Rulesets are repository settings and are not stored directly as versioned source files. This document records the intended ruleset state after branch protection and required CI were configured.

Evidence recorded

• Ruleset name: main-defensive-ci-protection
• Target: main
• Bypass list expected to be empty
• Pull request required before merge
• Conversation resolution required before merge
• Required status check: Static Defensive Validation
• Restrict deletions enabled
• Linear history enabled
• Restrict updates disabled to allow normal PR merges
• Deployment and signed-commit requirements deferred

Defensive scope

This change documents repository governance only. It does not scan external targets, install dependencies, run offensive tests, or modify runtime app behavior.

Validation expectation

This PR should trigger the Static Defensive Validation workflow and prove that the new CI gate is active on pull requests.