Record the live ruleset and complete the protected-path canary.
Add a stable Required CI gate, branch-protection desired state, and publishing runbook.