feat(fleet): add branch-protection example repo lane

.github/workflows/fleet-e2e.yaml

@@ -207,7 +207,7 @@ jobs:
           PRIMARY_REPO="primary"
           DEPENDENTS="artifact-a artifact-b"
           HEAVY_REPO="4env"
-          REMAINDER="3env 2env single-env release-only no-env callbacks rollback-dispatch"
+          REMAINDER="3env 2env single-env release-only no-env callbacks rollback-dispatch branch-protection"
           # -------------------------------------------------------------------
 
           RAW="${REPOS_INPUT:-all}"
@@ -369,13 +369,13 @@ jobs:
       - name: Repin each example repo to the rc
         run: |
           set -euo pipefail
-          # The full roster of 10 example repos. Repinning means: set manifest
+          # The full roster of 12 example repos. Repinning means: set manifest
           # cli_version to the rc, replace any other in-repo prerelease refs (rc/dryrun),
           # regenerate the workflows with the rc binary, then commit + push only
           # if something changed. This preserves every hand-written suite feature:
           # regeneration only rewrites the generated workflows, and we touch
           # nothing else.
-          REPOS="primary artifact-a artifact-b 4env 3env 2env single-env release-only no-env callbacks rollback-dispatch"
+          REPOS="primary artifact-a artifact-b 4env 3env 2env single-env release-only no-env callbacks rollback-dispatch branch-protection"
 
           # Apply the repin mutation to the checkout in the current directory:
           # point cli_version at the rc, rewrite any other in-repo rc refs, then
@@ -652,11 +652,11 @@ jobs:
             echo ""
             echo "| Lane | Result |"
             echo "|---|---|"
-            echo "| repin (all 10 repos to rc) | $R_REPIN |"
+            echo "| repin (all 12 repos to rc) | $R_REPIN |"
             echo "| primary | $R_PRIMARY |"
             echo "| dependents (artifact-a, artifact-b) | $R_DEPENDENTS |"
             echo "| 4env (heavy, alone) | $R_HEAVY |"
-            echo "| remainder (3env, 2env, single-env, release-only, no-env, callbacks, rollback-dispatch) | $R_REMAINDER |"
+            echo "| remainder (3env, 2env, single-env, release-only, no-env, callbacks, rollback-dispatch, branch-protection) | $R_REMAINDER |"
             echo ""
             echo "> rc gate: this conclusion is the fleet validation signal for"
             echo "> the rc tag. The repin step pinned each suite to this rc before"

docs/src/content/docs/coverage-matrix.md

@@ -18,9 +18,9 @@ below explains those choices.
 
 :::tip[Last validated]
 This matrix was last validated against the fully green live-fleet run behind `v0.5.1`:
-all eleven example repos (primary, artifact-a, artifact-b, single-env, 2env, 3env, 4env,
-release-only, no-env, callbacks, rollback-dispatch) passed every probe, and the shared
-fail-closed reconcile gate accounted for every run in each scenario window.
+all twelve example repos (primary, artifact-a, artifact-b, single-env, 2env, 3env, 4env,
+release-only, no-env, callbacks, rollback-dispatch, branch-protection) passed every probe,
+and the shared fail-closed reconcile gate accounted for every run in each scenario window.
 :::
 
 ## Why two layers, restated for this matrix
@@ -62,7 +62,7 @@ only under real installation tokens on the fleet, never in the token-free harnes
 
 | Feature | act plus gitea scenario | Live-fleet probe (repo) | Unit | What the layer proves |
 |---|---|---|---|---|
-| Orchestrate trunk build to release candidate | `01`, `02`, `03`, `04`, `34-extra-orchestrate-triggers` | every repo, orchestrate-on-merge (all 11) | `internal/orchestrate` | A trunk merge mints an RC draft and writes state, across every topology, on real Actions |
+| Orchestrate trunk build to release candidate | `01`, `02`, `03`, `04`, `34-extra-orchestrate-triggers` | every repo, orchestrate-on-merge (all 12) | `internal/orchestrate` | A trunk merge mints an RC draft and writes state, across every topology, on real Actions |
 | Default promotion (env to next env) | `04`, `promote/cascade-deploy-enabled` | `promote-staging` (2env, 3env, primary) | `internal/promote` | One promotion step copies source state into the target on a real release object |
 | Cascade-mode promotion (atomic multi-step) | `04-cascade-promotion` | `lifecycle` dev to prod (4env) | `internal/promote` | The full ladder advances through intermediates and publishes at the top |
 | Standalone release lane (draft, prerelease, publish) | `05-publish-callback`, `37`, `38` | dispatch prerelease then release (single-env); `release-only` | `internal/release` | A real release transitions draft to prerelease to published with RC reaping |
@@ -77,6 +77,7 @@ only under real installation tokens on the fleet, never in the token-free harnes
 | External update and notify (cross-repo) | `21-cross-repo-callback`, `multi-repo/*` | external-update from artifact-a and artifact-b, concurrent no-loss (primary) | `internal/external` | A satellite deploy writes the primary's shared manifest with no lost update |
 | Manage-release verbs (create, update, lock, prerelease, publish, delete) | `05-publish-callback` | `manage-release-verbs` lock to prerelease, orphan delete (primary); single-env stages | `internal/release` | Each release verb mutates the real release object as specified |
 | State write (Contents API) and retry-on-conflict | `08-state-push-retry` | state read-back after every step (all multi-step repos) | `internal/statewrite`, `internal/promote` | State commits land and survive a concurrent-writer race |
+| Branch-protection JSON generator | | `branch-protection-suite-orchestrate` (cascade-example-branch-protection) | `internal/branchprotection` | Generated JSON accepted by the GitHub classic branch-protection API; required-status-checks, enforce-admins, and PR-review fields match the hardcoded defaults |
 
 ## Guards and registered negatives