Protected config for v0.13.1 release: protected-only PR ahead of #192

[Chris-Wolfgang]

Protected-only PR extracted from the v0.13.1 release branch (vNext, #192) so the larger release diff can merge through full ruleset enforcement instead of an all-or-nothing admin bypass.

Why this PR exists

The Detect .NET Projects guard fails any PR touching protected config files, requiring an admin bypass — but a bypass waives all ruleset rules at once (including required review-thread resolution). Splitting the protected files into this minimal PR lets them get a focused manual review + bypass here, while #192 merges normally with every rule enforced.

Protected files included

• .editorconfig
• .github/workflows/codeql.yaml
• .github/workflows/pr.yaml
• .github/workflows/release.yaml
• .github/workflows/stryker.yaml
• BannedSymbols.txt
• Directory.Build.props

Expected CI

• Detect .NET Projects ❌ — expected; this is the guard the split exists to satisfy. Admin-bypass merge after reviewing the diff.
• Stage 1/2/3 SKIPPED (depend on the guard output).
• Other security scans ✅.

After merge

Merge main back into vNext so #192's protected-file delta vanishes and it becomes mergeable without bypass.

Follows: #192