ci: make build/test/clippy required status checks on main (#123)

[hellno]

What

Makes the real Definition-of-Done CI jobs required to merge into main, and turns on admin enforcement so the gate is real.

Live protection is already applied and verified (this PR adds the reproducible record + docs):

contexts: cargo-deny-advisories, cargo-deny-supply-chain, quick, linux, macos
enforce_admins: true     strict: false
required_signatures: true (preserved)     required_pull_request_reviews: absent (preserved)

Why

Before this, only the two cargo-deny jobs gated merges, so a PR could merge with the build red, tests failing, or clippy warnings — contradicting the repo's paste-the-evidence DoD. Surfaced in the /autoplan review of #82.

How

• scripts/branch-protection.sh — single source of truth. Default applies the desired state and self-verifies; --verify is a read-only drift audit (exit 1 on drift). Uses surgical endpoints (PATCH required_status_checks + POST enforce_admins), never a full PUT, so required_signatures and the deliberately-absent required PR reviews (solo auto-merge workflow) are left untouched. Rollback documented inline.
• docs/AGENTIC-ENGINEERING.md — notes the new gate and points at the script.

Decisions

• enforce_admins=true bundled in: without it an admin can bypass a red required check, so required-checks alone would be a soft guardrail. Reversible: gh api -X DELETE .../protection/enforce_admins.
• strict=false kept: the issue lists up-to-date-before-merge as optional; on a fast solo repo it forces a rebase before every merge. The script documents how to flip it on.

Verification

• shellcheck scripts/branch-protection.sh clean
• scripts/branch-protection.sh --verify → PASS on both assertions post-apply
• This PR is itself now gated by the new required checks (dogfood).

Closes #123