fix(branch-protection): stop reverting security remediation + clobbering repo checks

build_payload() previously did a wholesale full-body PUT that, on every run:
  1. re-added a code_scanning (CodeQL) merge-protection rule — GitHub's
     code-scanning gate is flaky (perpetually 'expects results'), deadlocking
     PRs into admin-only merges;
  2. re-added admin bypass_mode='always' + three Integration bypass actors
     (29110/1143301/1236702), REVERTING the 2026-06-29 bypass-actor security
     remediation;
  3. wrote an empty required_status_checks, WIPING each repo's own gates
     (e.g. a Rust repo's 'analyze (rust, none)' + 'llvm-cov line coverage').

Now:
  - no code_scanning rule (CodeQL enforced via a required_status_check instead);
  - bypass_actors = admin (RepositoryRole 5) at 'pull_request' only;
  - apply_one() reads the repo's existing required_status_checks and passes them
    to build_payload, so standardising is ADDITIVE (repairs the invariant
    baseline) and never clobbers per-repo gates.

Verified: payload is valid JSON, carries no code_scanning, single admin
pull_request bypass, and preserves supplied per-repo checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

scripts/branch-protection-apply.sh

@@ -85,16 +85,25 @@ fi
 # -----------------------------------------------------------------------------
 
 build_payload() {
-    cat <<'JSON'
+    # $1 = the repo's EXISTING required_status_checks array (JSON). Preserved so
+    # this standardiser repairs the invariant baseline WITHOUT clobbering the
+    # per-repo status checks a repo has legitimately added (e.g. rust/coverage).
+    #
+    # Deliberately NOT included here:
+    #   - bypass_actors Integration entries + admin "always": re-adding those
+    #     reverts the 2026-06-29 bypass-actor security remediation. Admin keeps a
+    #     "pull_request" bypass only.
+    #   - a code_scanning rule: GitHub's code-scanning merge-protection is flaky
+    #     (perpetually "expects results", deadlocking PRs). CodeQL is enforced via
+    #     a required_status_check instead, preserved per-repo above.
+    local existing_checks="${1:-[]}"
+    cat <<JSON
 {
   "name": "Base",
   "target": "branch",
   "enforcement": "active",
   "bypass_actors": [
-    {"actor_id": 5,       "actor_type": "RepositoryRole", "bypass_mode": "always"},
-    {"actor_id": 29110,   "actor_type": "Integration",    "bypass_mode": "always"},
-    {"actor_id": 1143301, "actor_type": "Integration",    "bypass_mode": "always"},
-    {"actor_id": 1236702, "actor_type": "Integration",    "bypass_mode": "always"}
+    {"actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "pull_request"}
   ],
   "conditions": {
     "ref_name": {"include": ["~DEFAULT_BRANCH"], "exclude": []}
@@ -109,12 +118,7 @@ build_payload() {
     {"type": "required_status_checks",
      "parameters": {"strict_required_status_checks_policy": false,
                     "do_not_enforce_on_create": true,
-                    "required_status_checks": []}},
-    {"type": "code_scanning",
-     "parameters": {"code_scanning_tools": [
-        {"tool": "CodeQL",
-         "alerts_threshold": "errors",
-         "security_alerts_threshold": "high_or_higher"}]}}
+                    "required_status_checks": ${existing_checks}}}
   ]
 }
 JSON
@@ -146,7 +150,15 @@ apply_one() {
         return 0
     fi
 
-    local payload; payload="$(build_payload)"
+    # Read the repo's own required status checks so the standardiser is additive
+    # (repairs the baseline rules) rather than wiping per-repo gates on the PUT.
+    local existing_checks='[]'
+    if [[ -n "${existing_id}" ]]; then
+        existing_checks="$(gh api "repos/${OWNER}/${repo_name}/rulesets/${existing_id}" \
+            --jq '([.rules[]? | select(.type=="required_status_checks") | .parameters.required_status_checks] | add) // []' 2>/dev/null || echo '[]')"
+        [[ -z "${existing_checks}" || "${existing_checks}" == "null" ]] && existing_checks='[]'
+    fi
+    local payload; payload="$(build_payload "${existing_checks}")"
     local attempt
     for attempt in 1 2; do
         if gh api "${url}" --method "${method}" --input - <<< "${payload}" >/dev/null 2>&1; then