How should branch protection and pull request checks be designed for production?

For production, require the checks that truly protect quality, protect the workflow files that define those checks, use CODEOWNERS where appropriate, and prevent administrators or automation from bypassing critical controls without traceability. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.