chore: replace classic branch protection with rulesets, protect tags, auto-merge Dependabot

[SyniRon]

Repository protection configuration is currently classic branch protection on develop only. This moves it to rulesets and closes two gaps.

Gaps

• Tags are unprotected. A published release tag drives build_and_push.yml → Docker Hub :latest → the Watchtower ping that recreates production. A moved or force-pushed tag is a direct production-deploy vector, and GitHub sunset classic tag protection rules in Aug 2024 — a ruleset is now the only mechanism.
• No explicit PR requirement, no linear-history requirement, and enforce_admins: false meant every control was admin-bypassable.

Target state

• Ruleset release-tags — target ~ALL (tags here are bare semver, 3.1.4; a refs/tags/v* pattern would match nothing), deletion + non_fast_forward, zero bypass actors.
• Ruleset default-branch — target ~DEFAULT_BRANCH, zero bypass actors: deletion, non_fast_forward, required_linear_history, required checks Build/Lint/Test with strict, and PR required with squash-only merges and review-thread resolution.
• Required approvals stay at 0. PR authors cannot approve their own PRs, and this repo has one active author — requiring an approval would block every PR and get routed around via bypass. The PR itself is the control, not the approval.
• .github/CODEOWNERS for routing only; require_code_owner_review stays off (it needs two or more active owners to be anything but a merge block).
• Dependabot non-major updates arm GitHub auto-merge; majors still land by hand.
• Classic protection deleted once a real PR has passed through the ruleset.

Declined

Signed commits (GitHub blocks squash-merging someone else's PR into a signing-required branch, and the standards that matter require signed releases and tags, not commits), the OpenSSF Scorecard workflow, merge queue, and a Dependabot bypass actor (unnecessary at 0 approvals).

[SyniRon]

Applied and verified.

Rulesets (both active, both zero bypass actors — admins included):

• release-tags (19850837), target ~ALL: deletion, non_fast_forward. ~ALL rather than refs/tags/v* because this repo tags bare semver (3.1.4); a v* pattern would have looked green and protected nothing.
• default-branch (19850848), target ~DEFAULT_BRANCH: deletion, non_fast_forward, required_linear_history, required Build/Lint/Test (app 15368, strict), PR required with 0 approvals, squash-only, stale-review dismissal and review-thread resolution on.

Repo settings were already aligned (squash-only, auto-merge, delete-branch-on-merge) — no change needed.

In-repo half landed in #244: .github/CODEOWNERS and .github/workflows/dependabot_auto_merge.yml.

Verification. #244 was the live test: it sat at BLOCKED until the required checks went green, then flipped to CLEAN and squash-merged. Classic protection was deleted only after that. /branches/develop/protection now returns 404 Branch not protected while /rules/branches/develop still lists all five rules. Note the asymmetry — GET /branches/develop still reports protected: true, which is the ruleset being reflected, not a stale classic rule.

Not yet exercised. The auto-merge job showed skipping on #244, which only proves the actor gate holds and the workflow parses. The merge step and the permissions: block are untested until a real Dependabot PR runs — next weekly batch is the first true test.

Known gap, tracked separately: go.yml triggers on push only, so a PR from a fork produces no check runs on this repo and can never satisfy the required contexts. That predates this change and only affects the 21 read-only collaborators, but it is now a hard block rather than a soft one.