fix: keep merge options in sync and add option to enforce review of latest push

[olzemal]

What

related to https://github.com/opendefensecloud/odd-internal/issues/44

Checklist

• Tests added/updated
• No breaking changes (or upgrade path documented above)
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

Summary by CodeRabbit

• New Features

  • Added optional approval for the latest push before merging, disabled by default.
  • Merge-method settings now consistently control the methods permitted by repository and branch protection rules.

• Bug Fixes

  • Repository configuration now reports an error when no merge method is enabled, preventing invalid settings.

• Documentation

  • Updated repository setup and configuration guidance for merge methods and latest-push approval.

[coderabbitai]

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes the checklist and issue reference but omits the required summary, motivation, testing details, and reviewer notes.	Add a one-sentence summary under What, explain the motivation under Why, document testing under Testing, and state whether reviewer notes are applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes both main changes: synchronized merge options and enforcement of latest-push review.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 103-105: Update the Branch protection documentation to state that
latest-push approval is required when REPO_REQUIRE_LAST_PUSH_APPROVAL is true,
replacing the ambiguous “when ... is set” wording while preserving the
surrounding ruleset description.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c49d33fa-f5bf-430b-8a00-5141bb5ff7cc

📥 Commits

Reviewing files that changed from the base of the PR and between 0f02960 and 016ce6b.

📒 Files selected for processing (4)

• README.md
• common.mk
• docs/NEW_REPO.md
• scripts/repo-settings.sh

[cbrgm]

LGTM