[codex] docs and ci: protect main and fix GitHub Actions

[omniscoder]

This PR does two things:

1. Syncs the public core docs with the live GitHub enforcement state.
2. Fixes GitHub Actions to use pnpm instead of npm ci so the repo can actually pass on GitHub.

What changed:

• main is branch-protected on GitHub with CLA required.
• packageManager now declares pnpm.
• CI and release workflows use pnpm install with the pnpm cache.

Validation:

• pnpm test -- test/docs-commands.test.ts
• git diff --check