Add migration-gate checks to branch protection required status checks

[chiptus]

Parent

#295 (Block merge on migrations without the staging label or a green staging push)

What to do

#295 added the Require staging label for migrations check (.github/workflows/migration-staging-gate.yml, merged in #298), and #294 already made the staging push job real. Neither one actually blocks merging yet — that requires adding them to main's required status checks in GitHub branch protection settings, which is a repo-settings change no workflow file or available tool can make. This has to be done by hand.

In the repo's branch protection settings for main, add these two checks as required:

• Require staging label for migrations (new, from ci(migrations): add staging-label merge gate #298)
• migrate / Push migrations (staging) (existing, from deploy.yml calling _db_migrate.yml)

Acceptance criteria

• A PR touching supabase/migrations/** without the staging label shows a failing required check and cannot be merged.
• Adding the staging label to that PR flips the check to passing without requiring a new commit.
• A PR holding staging whose staging push check is red still cannot be merged.
• A PR holding staging with a green staging push can be merged.
• A PR that doesn't touch supabase/migrations/** at all is unaffected regardless of the label.

Notes

Requires repo admin access. Not agent-actionable — no GitHub tool available to this session can modify branch protection rules.