Lock the branch out of hours.

Railcross locks your default branch on a schedule and unlocks it again — so nothing merges outside the window you choose. No bots, no CI changes.