Branch protection rules support

[yaleman]

feat: add status check validation and fix ruleset API handling
Added comprehensive status check validation to ensure required checks
actually exist in workflow files before enforcing them in branch protection.

Changes:

• Add _get_available_checks_for_repo() to parse workflow YAML files and extract job names
• Add _validate_required_checks() to compare required vs available checks with helpful warnings
• Integrate validation into both check and fix functions
• Fix _get_rulesets() to fetch full ruleset details instead of summaries
  (GitHub's list API returns rules: None and conditions: None)
• Fix filter logic to handle conditions: None (applies to all branches)
• Add debug logging for ruleset fetching and filtering
• Add 9 comprehensive unit tests for validation logic

Fixes:

• Silent exit bug in fix_legacy_protection_cleanup (filter wasn't matching rulesets)
• Missing PR rule detection (list API doesn't include full rule details)
• Legacy protection cleanup now successfully removes old protection
• Fix allow_admin_bypass to correctly allow/prevent admin bypass (was inverted)
• Add support for GitHub rulesets with admin bypass actors (role ID 5)
• Implement migration from legacy branch protection to rulesets
• Add separate check/fix for cleaning up legacy protection after migration
• Update CLAUDE.md with corrected configuration documentation

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com