Protect a branch (set policies)

I need the main branch locked down so hotfixes and merges follow our safety checks. Set branch policies that require two reviewers, successful CI build, and no direct pushes to main; make the policy apply to everyone except the release bot. Do one test merge from feature/urgent-fix to confirm rules block direct push, then tell me what failed and what changed so I can announce to the team.

Before I push this change to the team, make it easy for reviewers to accept branch protection: surface that two approvals and passing CI are required, show any exceptions (release bot), and call out the one workflow that will be blocked (direct pushes to main). Flag anything that could make a reviewer hesitate, such as required status checks that are flaky or long-running, and suggest a shorter status check to replace it.

I turned on a protection policy for main requiring two reviewers and green CI; Devin reports his hotfix push was rejected. I do not know whether it failed review, CI, or the 'no direct push' rule, and I cannot tell Devin more without breaking the rule for troubleshooting. What is the most likely cause and the next action to unblock the hotfix while keeping protections intact?

Over the last six months we repeatedly relax branch protections during incidents, then reapply them and lose the audit trail and developer trust. Which small habit change will preserve both emergency speed and long-term safety so we stop eroding the policy? Recommend a concrete guardrail and how to enforce it with minimal friction for on-call engineers.