ci(gov): add CODEOWNERS, PR template, and branch protection guidance

Introduces CODEOWNERS for mandatory review, standardized pull_request_template, and CONTRIBUTING updates describing required status checks and branch protection settings.

Author: Ricardo Sanchez

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Automatically require review from repository owner for any change
+* @ricardodsanchez
+
+# Generator and data changes always need review
+_data/** @ricardodsanchez
+scripts/generate_readme.rb @ricardodsanchez

.github/pull_request_template.md

@@ -0,0 +1,25 @@
+## Summary
+
+Describe the change and motivation.
+
+## Checklist
+
+- [ ] Updated `_data/resources.yml` (if adding/updating resources)
+- [ ] Ran `ruby scripts/generate_readme.rb` locally
+- [ ] README diff is committed
+- [ ] Link check passes (or false positives explained)
+- [ ] Status choices align with taxonomy
+- [ ] No direct edits to generated table formatting
+
+## Type of Change
+
+- [ ] feat
+- [ ] fix
+- [ ] docs
+- [ ] chore
+- [ ] refactor
+- [ ] ci
+
+## Notes for Reviewers
+
+(Optional) Anything surprising, rationale for status changes, or link exceptions.

CONTRIBUTING.md

@@ -78,6 +78,17 @@ Two GitHub Actions support quality:
 1. `Generate README` workflow ensures `README.md` matches `_data/resources.yml`. If it fails, run the generator and recommit.
 2. `Link Check` (weekly + on relevant PRs) validates external URLs. Fix or replace dead links when flagged.
 
+### Branch Protection & PR Requirements
+
+The `main` branch should be protected (enable in GitHub Settings > Branches):
+
+- Require pull request reviews before merging (CODEOWNERS enforces an owner review)
+- Require status checks to pass: `Generate README`, `Link Check`
+- Dismiss stale approvals on new commits (optional but recommended)
+- Restrict pushes so direct commits to `main` are disallowed
+
+After enabling protection, all changes must flow through PRs. If you see a bypass message in push output, protections are not fully configured yet.
+
 ### Optional Local Git Hook
 
 To automatically regenerate the README when editing `_data/resources.yml` you can enable the provided pre-commit hook: