Added a github-branch-protection skill to pi-setup. Lets the agent apply and audit branch protection rules without hand-editing jobs/settings — captured as a reusable skill the agent can call directly.