chore(rulesets): retire deadlocked Optimus-Branch and adopt canonical base.json

.github/rulesets/README.adoc

@@ -25,26 +25,28 @@ be described as existing.
 gh api --method POST \
   -H "Accept: application/vnd.github+json" \
   "/repos/{owner}/{repo}/rulesets" \
-  --input .github/rulesets/tag-protection.json
+  --input .github/rulesets/base.json
 
 # List what is actually in force — the only authoritative answer:
 gh api "/repos/{owner}/{repo}/rulesets" --jq '.[] | "\(.id)\t\(.name)\t\(.enforcement)"'
 
 # Update an existing ruleset in place (needs its numeric id from the list above):
 gh api --method PUT \
   "/repos/{owner}/{repo}/rulesets/<id>" \
-  --input .github/rulesets/tag-protection.json
+  --input .github/rulesets/base.json
 ----
 
 == Files
 
-`tag-protection.json`:: Makes release tags immutable — blocks tag creation,
-update and deletion, and requires signed tags. `bypass_actors` grants the
-repository *admin* role (`actor_id: 5`) an always-bypass, so a maintainer can
-still cut a release.
+`base.json`:: Canonical branch protection ruleset for the default branch (`~DEFAULT_BRANCH`).
+Enforces required signatures, linear history, squash merge, and deletion/force-push protection
+without unsatisfiable coverage or deadlocking approval requirements.
+
+`Immutable-Tags.json`:: Makes release tags immutable — blocks tag deletion,
+non-fast-forward updates, and overwrites, and requires signed tags.
 
 == Verifying
 
 Do not infer that a ruleset is active because the JSON is present. Check with the
 `gh api ... /rulesets` list above. A ruleset that exists as a file but was never
-POSTed is the tag-protection equivalent of a check that cannot fail.
+POSTed is the protection equivalent of a check that cannot fail.

.github/rulesets/base.json

@@ -0,0 +1,102 @@
+{
+  "name": "Base",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~DEFAULT_BRANCH"
+      ],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 1236702,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 29110,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 15368,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 347564,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 46505,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 1143301,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 1144995,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 12526,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    },
+    {
+      "actor_id": 2538504,
+      "actor_type": "Integration",
+      "bypass_mode": "pull_request"
+    }
+  ],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": false,
+        "required_reviewers": [],
+        "allowed_merge_methods": [
+          "squash"
+        ]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}