Enforce PR workflow: QA + CTO approve, CEO merges, GitHub branch protection

POLICIES.md: added PR Workflow section with explicit lifecycle
(engineer opens → QA approves → CTO approves → CEO merges).
Updated issue tracking to reference dual approval before merge.
Added branch protection enforcement directive.

CEO: added merge step to heartbeat, merge authority in SOUL.md,
branch protection enforcement responsibility.

CTO: removed merge authority, review and approve only.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cto/HEARTBEAT.md

@@ -54,15 +54,16 @@ Replace `{issueId}` with the actual issue ID. If checkout returns 409 (already c
       -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
       -d '{"status": "done", "comment": "Summarize what you did."}'
 
-### 3. Merge QA-approved PRs
+### 3. Review open PRs
 
-Check your Paperclip inbox for issues from Regina flagged as ready to merge.
+    gh pr list --state open --limit 20
 
-For each PR Regina has approved and escalated to you:
+For each open PR not yet reviewed by you:
 
-- Do a quick sanity check on the diff
-- If it looks good, merge it
-- If something looks off, comment on the Paperclip issue asking Regina or Gandalf to address it before you merge
+- Review the diff for architecture alignment, code quality, and security
+- Approve or request changes
+- Do NOT merge — CEO (Countess) merges after both your approval and QA (Regina) approval
+- If QA has not yet reviewed, create a Paperclip issue for Regina to review the PR
 
 ### 4. Triage open GitHub issues