POST /contents commits to a protected default branch: commitToBranch skips repo.protectDefault and size caps #5132

Found reviewing #5125. commitToBranch (src/actions/repos.ts) never checks repo.protectDefault, which editFiles (src/actions/contents.ts) does, and has no per-file or per-commit size cap. A writer can commit straight to a protected default branch through POST /api/v1/repos/{owner}/{name}/contents. Fix: route /contents through the same guards as editFiles, add tests, then add protected_branch and the size codes to the OpenAPI row.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.