docs: correct branch protection status and the frontend CI steps (#24)

The repository is public and main carries an active 'protect main' ruleset, so
both CLAUDE.md and README.md were describing a state that no longer exists.
Both said protection could not be enforced because a private repo on the Free
plan cannot have required status checks.

The CI table also listed 'tsc -b --noEmit' as a distinct frontend step. No such
step exists: the job runs 'pnpm --filter frontend build', which is 'tsc -b'
followed by 'vite build', and no --noEmit is involved.

Adds the consequence of strict_required_status_checks_policy to CLAUDE.md,
since it is not obvious that requiring an up to date branch means every merge
invalidates every other open PR.

Author: unxwn

CLAUDE.md

@@ -108,10 +108,10 @@ lowercase subject, no trailing period. Types: `feat` `fix` `refactor` `perf`
 `.github/workflows/ci.yml` runs on every PR into `main` and must be green to
 merge. Two parallel jobs:
 
-| Job        | Steps                                                                                    |
-| ---------- | ---------------------------------------------------------------------------------------- |
-| `backend`  | restore → `dotnet format --verify-no-changes` → build (Release) → `dotnet test`          |
-| `frontend` | `pnpm install --frozen-lockfile` → `format:check` → `lint` → `tsc -b --noEmit` → `build` |
+| Job        | Steps                                                                                             |
+| ---------- | ------------------------------------------------------------------------------------------------- |
+| `backend`  | restore → `dotnet format --verify-no-changes` → build (Release) → `dotnet test`                   |
+| `frontend` | `pnpm install --frozen-lockfile` → `format:check` → `lint` → `build` (`tsc -b` then `vite build`) |
 
 Run the same checks locally before pushing:
 
@@ -121,17 +121,24 @@ dotnet test backend/VoxLib.slnx
 pnpm format:check && pnpm lint && pnpm build
 ```
 
-**Branch protection is not currently enforced.** `vox-lib` is a private repo on
-the GitHub Free plan, where both the rulesets API and the Settings → Branches UI
-refuse with `Upgrade to GitHub Pro or make this repository public`. CI still runs
-and still reports on every PR. It just cannot be made a required check, so
-nothing mechanically blocks a direct push to `main`. Until the repo goes public
-or the account goes Pro, the PR workflow above holds by discipline.
-
-If that changes, protect `main` with: require a PR, require the
-`backend (build + test)` and `frontend (lint + build)` checks (the job `name:`
-values in `ci.yml` are the status-check contexts), and require the branch to be
-up to date.
+**Branch protection is enforced.** The repository is public, and `main` carries a
+`protect main` ruleset that requires a pull request, requires the
+`backend (build + test)` and `frontend (lint + build)` checks to pass, requires
+the branch to be up to date with `main` before merging, and blocks force-push and
+deletion.
+
+The job `name:` values in `ci.yml` are what GitHub matches as status-check
+contexts. Renaming a job silently stops satisfying the rule, so the ruleset has to
+be updated in the same change.
+
+`required_approving_review_count` is 0 by design. GitHub does not allow approving
+your own pull request, so requiring a review on a solo project would make every PR
+permanently unmergeable.
+
+Requiring the branch to be up to date has a cost worth knowing: every merge into
+`main` invalidates every other open PR, which then needs a rebase and a fresh CI
+run. With several dependency PRs open at once, group them into one rather than
+merging them one at a time.
 
 ## Tests
 

README.md

@@ -99,12 +99,10 @@ full convention.
 
 ## Repository
 
-The remote is `github.com/unxwn/vox-lib` (private). Branch protection is **not**
-enforced: on the GitHub Free plan a private repo cannot have required status
-checks. The API and the Settings UI both answer `Upgrade to GitHub Pro or make
-this repository public`. CI still runs on every PR and reports its result; it
-simply is not a merge gate. The PR workflow above therefore holds by convention,
-not by enforcement.
+The remote is `github.com/unxwn/vox-lib` (public). Branch protection is enforced
+by the `protect main` ruleset: a pull request is required, both CI checks must
+pass, the branch must be up to date with `main` before it can merge, and
+force-push and deletion are blocked. CI is a merge gate, not a report.
 
 ## Licence