- cli/branch_protect_org.php: enforces push whitelist on main, dev, rc,
beta, alpha across all org repos (--dry-run supported)
- branch-protection-enforce.yml: runs weekly Monday 6am UTC + manual dispatch
- Branch flow: feature/* -> dev -> rc -> main (no direct push to any)