feat: allow admins team to force push protected branches

AGENTS.md

@@ -24,7 +24,8 @@ personal-dev organization: no required status check contexts and zero required
 approving reviews (see the comment in `gh-protections.tf`). PRs are used for CI
 validation, plan output, and change history, not as a review gate. Do not
 tighten `contexts` or `required_approving_review_count` unless explicitly
-requested.
+requested. The `admins` team may also force-push (`force_push_bypassers`) for
+history maintenance; all other force pushes remain blocked.
 
 GitHub silently drops branch-protection bypass actors that have no repository
 access at write time — the apply succeeds but the stored rule omits them, so

gh-protections.tf

@@ -10,6 +10,7 @@ resource "github_branch_protection" "protections" {
   pattern                         = "main"
   enforce_admins                  = false
   allows_force_pushes             = false
+  force_push_bypassers            = ["${var.github_owner}/${github_team.admins.slug}"]
   required_linear_history         = true
   require_conversation_resolution = true
   required_status_checks {