fix(.asf.yaml): discussions notification target + real check names in branch protection

.asf.yaml

@@ -49,14 +49,15 @@ github:
   dependabot_alerts: true
   dependabot_updates: false
 
-  # --- OPTIONAL self-serve branch protection (enable once the project agrees on required checks) ----
+  # --- Branch protection: 1 approving review + green CI required to merge to master -----------------
   protected_branches:
      master:
        required_pull_request_reviews:
          required_approving_review_count: 1
          dismiss_stale_reviews: true
        required_status_checks:
          strict: true
+         # Contexts must be check-run (job) names as reported to GitHub, not workflow names.
          contexts:
            - Code Quality
            - Security Checks