Block pushes and commits to main with git hooks

pre-push rejects any push that would update refs/heads/main, however the
command is spelled; pre-commit and pre-merge-commit refuse commits while
main is checked out. npm install enables them via core.hooksPath. The
README documents the three layers of protection for main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.githooks/pre-commit

@@ -0,0 +1,7 @@
+#!/bin/sh
+# Refuse commits (and, via pre-merge-commit, merge commits) while main is checked out.
+if [ "$(git symbolic-ref --short -q HEAD)" = "main" ]; then
+  echo "$(basename "$0"): committing on main is not allowed; create a branch first." >&2
+  exit 1
+fi
+exit 0

.githooks/pre-merge-commit

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec "$(dirname "$0")/pre-commit"

.githooks/pre-push

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Reject any push that would create, update or delete main on the remote, however the
+# command is spelled (bare `git push`, HEAD:main, +main, refs/heads/main, --all, --mirror).
+# Only a human merges into main, through a PR in Gitea.
+while read -r local_ref local_sha remote_ref remote_sha; do
+  if [ "$remote_ref" = "refs/heads/main" ]; then
+    echo "pre-push: pushing to main is not allowed; push a branch and open a PR instead." >&2
+    exit 1
+  fi
+done
+exit 0