VD-3016: add repo and CI guardrails (providers)

[arpit-acceleratedata]

Part of VD-3016 (with accelerate-data/obot#22 — the issue closes when both merge).

Adds the repo/CI guardrails that make this fork's images reliable Studio release inputs. The main-branch-protection ruleset is already applied live (required checks go-test / docker-build, PR + 1 approval, no force-push/deletion); this PR lands the workflow the docker-build check name comes from, and is itself the proof both checks report and pass.

Changes

• New docker-build-check.yml — PR-time amd64 build of both Dockerfile targets (providers, encryption-bins), no push. This is the repo's real build contract: go-test alone never exercises the Dockerfile, so a broken image build previously surfaced only on the main publish run.
• test.yaml — ready_for_review trigger (upstream-sync drafts are created with GITHUB_TOKEN, whose events start no workflows; without this, required checks never report on sync PRs and they can never merge) and setup-go v4 → v5 (deprecated runner, flagged by actionlint).
• .github/rulesets/main-branch.json — the applied ruleset, versioned in-repo.
• New AGENTS.md — CI gates, fail-closed publish contract, failure ownership, local verification commands.

Verification

• actionlint clean on both workflows
• Ruleset JSON validated against a live org ruleset shape and applied successfully (id 18491862)
• Publish workflow confirmed fail-closed as-is (untagged digest pushes → manifest merge → arch verification → cosign); not modified
• Adversarial subagent review of the diff; its one confirmed finding (sync-PR merge deadlock) is fixed by the ready_for_review trigger

🤖 Generated with Claude Code

[linear-code]

VD-3016