docs(nis2): describe the branch rules without the owner's bypass

[maksimtech]

The owner removed the bypass from the main ruleset on 2026-10-12 (and, in exeradar and patchradar, added the pull-request rule). docs/nis2-compliance.md still described the old rules.

• The branch-rules paragraph gives the rules as read from the settings on 2026-10-12: pull request required for every change, the version bump included, no exception for the maintainer's account; required checks and merge methods as configured. The earlier state is kept as past.
• tests/test_nis2_evidence.py holds the new wording and refuses the old phrases.
• release.sh (where there is one) falls back to a rebase merge when the ruleset refuses a squash: apkradar allows rebase merges only.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codspeed]

Merging this PR will not alter performance

⚠️ 11 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_api_cves_filtered
• test_init_db
• test_add_to_watchlist
• test_api_cves
• test_get_watchlist
• test_get_cves
• test_nvd_fetch_cves
• test_api_stats
• test_api_cve_detail
• test_get_cves_by_software
• …and 1 more

✅ 17 untouched benchmarks

---

_{Comparing docs/rules-without-bypass (d6e1165) with main (bdf4981)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!