fix: pass the repository to gh signoff install through GH_REPO

gh signoff install accepts only --branch; any other dashed option is an
unknown-option failure. Under set -e the script stopped there, after the
branch-protection PUT had landed and before the signoff ruleset existed,
so a transition run would have kept main on the Actions checks alone and
a --local-only run would have left it with no status requirement at all.
The extension resolves the repository through gh api repos/:owner/:repo,
which GH_REPO overrides.

Claude-Session: https://claude.ai/code/session_0125BCU48L9AmmM1JbBKeyQe

Author: vivek7405

scripts/protect-main.sh

@@ -81,7 +81,9 @@ JSON
 if ! gh extension list 2>/dev/null | grep -q 'basecamp/gh-signoff'; then
   gh extension install basecamp/gh-signoff
 fi
-gh signoff install --repo "$REPO"
+# The extension takes no --repo (only --branch); it resolves the repository
+# through `gh api repos/:owner/:repo`, which GH_REPO overrides.
+GH_REPO="$REPO" gh signoff install
 
 if [ "$MODE" = "local-only" ]; then
   echo "main is now protected: 1 approving CODEOWNER review + a signed-off local CI run (npm run ci -- --signoff) before merge. No Actions check is required."