[Monorepo] SPIKE: Require PR approvals on main without blocking CI/CD

[laurabelinfante]

Summary

Investigate how to require PR approvals for merges to main without blocking automated CI/CD steps. Billy's prior attempt (#351, closed) flagged that GitHub requires a PR to be required before reviews can be required, which conflicts with direct-push CI/CD workflows. Jeff Crichlake surfaced a community thread with possible workarounds: https://github.com/orgs/community/discussions/25305#discussioncomment-8256560

Acceptance criteria

• Constraints of GitHub branch protection around PR + review requirements documented
• Workarounds from thread evaluated against CommonGrants CI/CD setup
• Recommendation made on whether and how to enable approval requirement without breaking automation

References

• Prior ticket: [Infra] Update branch protections for main #351 [Infra] Update branch protections for main (closed)
• Related umbrella: [Release Mgmt] Security improvements #567 [Release Mgmt] Security improvements (Q7)