Enable branch protection — 13 workflows, none of them required

[christian-byrne]

What — main has no branch protection rule, so none of the repo's 13 workflows is a required status check.

Why it matters here — This is a public package with 45 contributors and 30 published releases. pytest, ruff, build-and-test, and the mac/windows/GPU matrices all run on every PR and every one of them is advisory — a PR with a red test suite can be merged and published. The checks are already written and already run; they just do not block. Of the six repos swept this is the one where the gap costs the most, because releases go to PyPI.

Evidence

$ gh api repos/Comfy-Org/comfy-cli/branches/main/protection
gh: Branch not protected (HTTP 404)

$ ls .github/workflows/ | wc -l
13

$ gh api repos/Comfy-Org/comfy-cli -q '"contributors_visible releases=\(.  )"' ; gh api repos/Comfy-Org/comfy-cli/releases -q length
30

Fix

Settings → Branches → rule for main: require a PR with at least one approval, require pytest, ruff_check, and build-and-test as status checks, block force pushes. Leave the GPU and mac/windows matrices advisory if they are flaky, but make the core three required.

---

Found by repo-audit during repo improvement sweep 2026-08-17. Parent: #723