feat(setup-remotes): pin branch.main.pushRemote to origin

Direct pushes on the canonical branch now target upstream instead of
the personal fork whose branch-protection rules can diverge. Feature
branches still fall back to the fork via remote.pushDefault.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_apply_push_config.py

@@ -0,0 +1,37 @@
+"""Verify `apply_push_config` writes the expected git-config keys."""
+
+from __future__ import annotations
+
+from git_maintainer_tools import setup_remotes
+
+
+def test_apply_push_config_writes_all_three_keys(monkeypatch):
+    calls: list[tuple[str, ...]] = []
+
+    def fake_run_git(*args, **kwargs):
+        calls.append(args)
+
+    monkeypatch.setattr(setup_remotes.g, "run_git", fake_run_git)
+    setup_remotes.apply_push_config()
+
+    config_sets = [a for a in calls if a[:1] == ("config",)]
+    assert ("config", "remote.pushDefault", "fork") in config_sets
+    assert ("config", "push.default", "current") in config_sets
+    assert ("config", "branch.main.pushRemote", "origin") in config_sets
+
+
+def test_main_push_override_is_origin_not_fork(monkeypatch):
+    """Regression: main must pin to origin so pushes never hit the fork."""
+    calls: list[tuple[str, ...]] = []
+
+    def fake_run_git(*args, **kwargs):
+        calls.append(args)
+
+    monkeypatch.setattr(setup_remotes.g, "run_git", fake_run_git)
+    setup_remotes.apply_push_config()
+
+    main_overrides = [
+        a for a in calls
+        if a[:2] == ("config", "branch.main.pushRemote")
+    ]
+    assert main_overrides == [("config", "branch.main.pushRemote", "origin")]