Adopt "sentinel" pattern in this repo

[blampe]

Some commits were recently merged despite failing checks because we were missing a branch protection for "deploy/update_workflows".

https://github.com/pulumi/ci-mgmt/commits/master/

We should adopt the "sentinel" pattern in this repo's workflows, so we only need to specify one requirement in the UI and then that thing can be managed via code.

[guineveresaenger]

While managing this type of thing with code will help, I also believe that whenever we change important repo settings, we should log this in an issue.

Code is not a stand-in for a bug or decision log.