feat(fleet): add branch-protection example repo lane

[joshua-temple]

What

Wires the new cascade-example-branch-protection example repo into the staged fleet as a remainder lane and updates the coverage matrix to 12 repos (correcting a pre-existing count).

Why

Closes the branch-protection coverage gap (#412). The new repo's suite generates the protection JSON via cascade branch-protection, applies it to a throwaway branch via the GitHub branch-protection API, reads it back, and asserts the live ruleset matches what cascade generated - the real-GitHub proof the unit tests cannot give.

Changes

• fleet-e2e.yaml: branch-protection added to the remainder lane and the repin roster; the Fleet gate aggregates it and the reconcile gate covers it via remainder membership. Concurrency unchanged (remainder max-parallel 2, sequenced after heavy). Corrected the stale 10-repo count to 12.
• coverage-matrix.md: 12 repos, new branch-protection row (scoped as a JSON generator the suite applies).

Verification

actionlint clean on fleet-e2e.yaml; no Go files touched. The new repo's state-token secret provisioning is a separate maintainer step.

Part of the feature-coverage goal (#412).

[joshua-temple]

Superseded. Applying branch protection requires repo-admin authority, so the real-GitHub fleet approach is an adoption blocker. Replaced by the CLI branch-protection --apply --token capability + hermetic mock-server coverage (#416). The cascade-example-branch-protection repo is being decommissioned.