chore: harden dual-remote git workflow

CONTRIBUTING.md

@@ -58,6 +58,17 @@ Default rule:
 - normal product work goes to `origin`
 - TUBCO pushes happen only when explicitly requested
 
+Safety rules in this repo:
+- plain `git push` should default to `origin`
+- pushes to `tubco` are guarded by a repo-local `pre-push` hook
+- only these refs should go to `tubco`:
+  - `release/tubco-*`
+  - `tubco-baseline-*`
+
+Authentication rule:
+- prefer a personal access token for the `tubco` HTTPS remote
+- do not rely on a reusable account password long term
+
 ## Current Delivery Model
 - GitHub Actions is used for CI
 - the current test server is local/LAN-only