Isn't that what branch policies are for? It can get annoying when making a release (from a local machine as opposed to automatically in CI/CD pipelines), but in other circumstances it serves the purpose very well in my experience
git itself has no concept of branch policies, it is purely a server side thing. But surely it doesn't really matter what branch you commit to locally, if you can't push it, you haven't done any damage and can just create a new branch and push that instead?
Yes, but I'd like to avoid the "create a new branch, switch back to main, reset main back to origin, come back to the new branch" dance. And a git hook does that, but it's not trivial to set up (particularly when there are lots of repos).