feat: protect maintenance branches

[zoeyrose]

Summary

• add desired-state support for exact non-default maintenance branches in both Team organization rulesets and the repository-level fallback
• protect content/1.x (refs/heads/1.x) from deletion and non-fast-forward updates and require linear history plus pull requests
• require the already-emitting Conventional PR title check on 1.x without prematurely requiring Content validation
• validate maintenance entries semantically, clean up stale managed maintenance rulesets safely during policy-scope migration, and exercise both publisher paths against a fake API

Safe staged CI policy

The live content/1.x branch was verified at 01b1fdb65c2243df4bafe9c8109fc93229df0121. pull_request_target already emits Conventional PR title without a base-branch filter. The content validation workflow currently targets only main, so requiring Content validation now would deadlock maintenance pull requests. A follow-up content workflow change must enable and prove that check on 1.x, then add it to this entry before applying the tighter policy.

Fresh replacement repositories remain absent from required_ci.

Validation

• bin/validate
• bash -n bin/publish bin/publish-repositories bin/validate tests/publish-maintenance-branch.sh
• shellcheck bin/publish bin/publish-repositories bin/validate tests/publish-maintenance-branch.sh
• tests/publish-maintenance-branch.sh
• actionlint
• git diff --check
• bin/publish against the live Team organization in plan mode

The live plan contains one new organization-ruleset POST, no ruleset deletion, and no settings apply. Local fake-API apply tests inspect the generated payload for both policy scopes and confirm the exact branch, repository, rule types, GitHub Actions integration ID, stale-rule cleanup, and absence of fresh-repository CI rules.

Review and rollback

Do not run bin/publish --apply until this pull request is merged and separately authorized. To roll back after a future apply, remove the maintenance entry, merge that reviewed change, and confirm the plan deletes only 05 - Maintenance branch - content - 1.x before applying.

Manual verification

No runtime topology applies to organization policy. From this branch run:

bin/validate
tests/publish-maintenance-branch.sh
actionlint
bin/publish

[github-actions]

🎉 This PR is included in version 1.2.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀