[Engineer] feat(engineer): implement issue-92 plan

[bestony]

[Engineer]

• Workflow: Engineer

自动执行计划任务的实现 PR。

• Plan file: plans/92-default-branch-ruleset-verify.md
• Trigger: scheduled engineer workflow
• Linked issue: [Default Branch Ruleset Verify] default branch merge gate drift detected #92

Closes #92

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[github-actions]

[Reviewer Workflow]
Reviewer: Tech Lead

• If org ruleset listing/fetch fails (e.g. insufficient token scope or API error), the script still concludes FAIL when no active ruleset is found, even though org rulesets were not evaluated. This can generate false drift alerts in org-owned repos. Suggestion: when any org ruleset request fails, mark the result as INCONCLUSIVE/WARN (or skip FAIL) and surface the warning prominently so operators can fix permissions before flagging drift.

[github-actions]

[Reviewer Workflow]
Reviewer: Tech Lead

• scripts/workflows/ruleset-verify/ensure-default-branch-ruleset.sh: when multiple rulesets apply to the default branch, the script updates the first one returned by the API, which is not deterministic and may target the wrong ruleset. Suggest filtering by RULESET_NAME (or ID) and failing fast if multiple matches remain.
• scripts/workflows/ruleset-verify/ensure-default-branch-ruleset.sh: updates always force enforcement: "active", which can unintentionally enable a ruleset that was previously evaluate or disabled. Suggest preserving the existing enforcement unless an explicit env flag requests activation.