fix(backtrack): lock both branches during backtrack, restore permanent protection after

Agent-Logs-Url: https://github.com/petesramek/polyline-algorithm-csharp/sessions/1b29c883-dc1f-40a8-8c17-6a3cef7ef9f4

Co-authored-by: petesramek <2333452+petesramek@users.noreply.github.com>

Author: Copilot

.github/actions/github/branch-protection/lock/action.yml

@@ -8,6 +8,10 @@ inputs:
   token:
     description: 'GitHub token with administration:write (repo admin) permission. Use a PAT; GITHUB_TOKEN cannot call the branch protection API.'
     required: true
+  lock-branch:
+    description: 'When true, sets lock_branch to prevent even PR merges (use during automated operations). When false (default), only direct pushes are blocked; PRs with required reviews can still be merged.'
+    required: false
+    default: 'false'
 
 runs:
   using: composite
@@ -30,7 +34,7 @@ runs:
           "restrictions": null,
           "allow_force_pushes": false,
           "allow_deletions": false,
-          "lock_branch": false
+          "lock_branch": ${{ inputs.lock-branch }}
         }
         EOF
         then

.github/workflows/backtrack.yml

@@ -61,13 +61,23 @@ jobs:
             echo "::warning::Develop branch '${{ steps.targets.outputs.develop-branch }}' not found, skipping backtrack."
           fi
 
+      - name: 'Lock preview branch'
+        id: lock-preview
+        if: ${{ steps.targets.outputs.preview-branch != '' }}
+        uses: './.github/actions/github/branch-protection/lock'
+        with:
+          branch: ${{ steps.targets.outputs.preview-branch }}
+          token: ${{ secrets.GH_ADMIN_TOKEN }}
+          lock-branch: 'true'
+
       - name: 'Lock develop branch'
         id: lock-develop
         if: ${{ steps.check-develop.outputs.exists == 'true' }}
         uses: './.github/actions/github/branch-protection/lock'
         with:
           branch: ${{ steps.targets.outputs.develop-branch }}
           token: ${{ secrets.GH_ADMIN_TOKEN }}
+          lock-branch: 'true'
 
       - name: 'Backtrack: merge ${{ github.base_ref }} into ${{ steps.targets.outputs.preview-branch }}'
         if: ${{ steps.targets.outputs.preview-branch != '' }}
@@ -89,6 +99,22 @@ jobs:
             --field head="${{ steps.targets.outputs.merge-source }}" \
             --field commit_message="Backtrack: merge ${{ steps.targets.outputs.merge-source }} into ${{ steps.targets.outputs.develop-branch }}"
 
+      - name: 'Restore protection: preview branch'
+        if: ${{ always() && steps.lock-preview.outcome == 'success' }}
+        uses: './.github/actions/github/branch-protection/lock'
+        with:
+          branch: ${{ steps.targets.outputs.preview-branch }}
+          token: ${{ secrets.GH_ADMIN_TOKEN }}
+          lock-branch: 'false'
+
+      - name: 'Restore protection: develop branch'
+        if: ${{ always() && steps.lock-develop.outcome == 'success' }}
+        uses: './.github/actions/github/branch-protection/lock'
+        with:
+          branch: ${{ steps.targets.outputs.develop-branch }}
+          token: ${{ secrets.GH_ADMIN_TOKEN }}
+          lock-branch: 'false'
+
       - name: 'Write backtrack summary'
         if: ${{ always() }}
         run: |