docs(agents): forbid direct pushes to main

[jonpspri]

Related Issue

Process change requested directly by the maintainer after three session commits (65743e8, 5cab1c2, 2a94003) landed on main without review.

---

Summary

Make the no-direct-push policy explicit in AGENTS.md:

• Never push directly to main — no exceptions for maintainers, admins, or AI agents. Every change (code, tests, CI, docs, tooling) lands on a branch and merges via PR; direct pushes bypass review and the required CI gates.
• AI agents stop at the PR: commit to a branch, push, open the PR, never merge and never push main, even when asked to "ship"/"deliver"/"publish".
• Existing rules (issue-first, PR template) unchanged.

Root cause enabling the bypass: branch protection has enforce_admins=false, so administrators skip all 5 required status checks. Recommended follow-up (repo settings, not this PR): enable Include administrators for main so the rules bind everyone. With required_approving_review_count=0 (solo-maintainer friendly) PRs remain self-mergeable while still running the CI gates.

---

Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate (docs-only change; N/A)

---

Type of Change

• Documentation

---

Verification

Check	Command	Status
Tests	pytest	N/A (docs-only, no code paths touched)
Lint	ruff check .	N/A
Type check	mypy src/	N/A

Manual: rendered diff reviewed; markdown structure matches the existing ## Contribution workflow section style.

---

Checklist

• Tests added/updated for changes and pytest passes (N/A docs-only)
• ruff check . and mypy src/ are green (N/A docs-only)
• Documentation updated
• Commits signed off (git commit -s, DCO)
• No secrets, credentials, or private keys committed