Say in CONTRIBUTING that main is protected, and that strings need nine catalogues

Two things a contributor could only find out by tripping over them.

`main` now carries a ruleset: a pull request with a green build check, no
force-push, no deletion, and deliberately no required approval -- which
would lock a solo maintainer out of their own repository rather than
protect anything.

And a new user-visible string is work in nine catalogues. A missing key
renders its English source rather than failing, so the omission is
invisible from here and obvious to anyone reading that language. The
plural-key trap is in CLAUDE.md rather than repeated here.

Docs only. No strings added, no catalogues touched.

CONTRIBUTING.md

@@ -48,6 +48,17 @@ For larger changes, please open an issue to discuss the approach **before** subm
    - Related issue number(s), if any
    - Screenshots/GIFs for UI changes
    - Any manual testing you performed
+8. **Add translations** for any new user-visible string. Nine languages ship
+   alongside English in `web/src/locales/`, and a missing key renders its
+   English source rather than failing — so an untranslated string is invisible
+   until somebody reading that language finds it. `npm run i18n:check` and
+   `node scripts/i18n-catalog-check.mjs` report where you stand; the catalogue
+   key for a plural is the `other` form. See [CLAUDE.md](CLAUDE.md).
+
+`main` is protected. A change reaches it through a pull request whose **build**
+check has passed — not afterwards — and the branch cannot be force-pushed or
+deleted. No approving review is required, so a PR of your own is not blocked
+waiting for one.
 
 ### Code Style