argh. Just found out (in a way that could have been much worse) that Github's branch protection policies have died to Microsoft's freemium plan. I knew they wouldn't allow new branch protections, but didn't know they had lifted the old ones.