Document branch protection rules and maintainer workflow

### Description
The repository enforces PR-only changes to `main` (branch rules).  
This workflow should be documented for maintainers.

### Acceptance criteria
- [ ] Document that `main` cannot be pushed directly
- [ ] Describe the maintainer fix workflow:
  - create fix branch
  - open PR
  - merge PR
- [ ] Add this to CONTRIBUTING.md or maintainer docs