security: require independent review and immutable release refs #484

Goal

Make a compromised maintainer credential insufficient to merge a release-path change or move a production release tag.

Current evidence

The live default-branch ruleset currently requires zero approving reviews and has no CODEOWNERS review requirement. The repository rulesets also do not include a protected v* tag rule.

Scope

• Require at least one independent approval for merges to main.
• Require code-owner review for release workflows, packaging metadata, dependency locks, release validators, and VERSION.
• Require approval from the last-push reviewer and dismiss stale approvals.
• Add an immutable protected-tag ruleset for v*: no deletion, force-update, or unreviewed creation.
• Keep bypass actors empty and document the emergency recovery procedure.

Acceptance criteria

• A pull request changing a release-path file cannot merge without the required independent review.
• A production tag cannot be force-moved or deleted through normal repository permissions.
• A regression test or auditable configuration check proves the rules are active.
• CONTRIBUTING/releasing documentation explains the review and tag controls.

This is a v1.0 supply-chain security gate motivated by the 2026 PyPI compromise review.