repo-protectionlisted

# Repository Protection Audit or apply baseline protection per: **$ARGUMENTS** (preset inferred from repo visibility when omitted; `--review` reports without changing anything) ## Steps 1. **Audit what exists.** Never propose from assumption — read the live state: ```bash gh api repos/<owner>/<repo> --jq '{private, default_branch, security_and_analysis}' gh api repos/<owner>/<repo>/rulesets --jq '.[] | {id, name, enforcement}' gh api repos/<owner>/<repo>/actions/permissions/workflow gh api repos/<owner>/<repo>/vulnerability-alerts --silent && echo alerts-on ``` 2. **Find the real CI contexts.** A required status check is matched by *exact name*, and a required context nothing produces sits at "Expected — waiting for status to be reported" forever, blocking every PR. Derive them from what actually ran, not from the workflow file: ```bash gh api repos/<owner>/<repo>/commits/<default-branch-sha>/check-runs --jq '.check_runs[].name' ``` A job with no `name:` reports under its job id. **Renaming a CI job silently strands the required context** — say so when you apply this. 3. **Pick the preset.** `templates/ruleset-oss.json` for public repos; `templates/ruleset-private.json` for private or solo ones, which drops the review requirement (an approval only you can give is ceremony you bypass every time, and a rule routinely bypassed trains you to ignore it). Substitute the real contexts from step 2. 4. **Keep a bypass actor.** `{"actor_id": 5, "acto