feat(rulesets): reverse-engineer org branch protection + add review gate, conventional commits

[JacobPEvans-personal]

Summary

Codifies the pre-Terraform live state of the org-level rulesets and applies the directives from PR #2 / #3 review feedback. Single PR because the import blocks must land together with the new resources to avoid duplicate ruleset creation on next apply.

What lands

New rulesets:

Resource	Behavior
org_branch_protection	Non-bypassable quality gate. required_linear_history, required_signatures, branch name pattern, strict Conventional Commits regex, PR thread resolution. No bypass — applies to every actor including OrganizationAdmins.
org_review_gate	Separate ruleset for the review gate so the admin bypass doesn't weaken the quality gates above. 1 approving review + CODEOWNER review on PRs. OrganizationAdmin bypass in pull_request mode — any admin merges their own PRs without external review; non-admin actors must obtain it.

Existing ruleset reconciled:

• markdown_lint updated to match live state for clean import — ref_name = ~ALL (was ~DEFAULT_BRANCH), do_not_enforce_on_create = true. Default enforcement stays evaluate (legacy); live is currently disabled so apply moves it disabled → evaluate. Pass -var markdown_lint_enforcement=active to flip on.

Import blocks:

```hcl
import { to = github_organization_ruleset.org_branch_protection
id = "15555419" } # was "main"
import { to = github_organization_ruleset.markdown_lint
id = "17062292" } # was "Required Workflows - All Branches"
```

Directive answers

Q	Answer	Implementation
1	1 reviewer unless author == operator	OrganizationAdmin bypass on org_review_gate.pull_request (closest GitHub supports — rulesets have no per-author conditional rules)
2	CODEOWNERS only on critical files	Deferred to follow-up PR — see "CODEOWNERS deliberately not in this PR" below
3	Conversation resolution required everywhere	required_review_thread_resolution = true in both rulesets
4	Signed commits required + flag unverified	required_signatures = true in org_branch_protection, no bypass
5	Strict Conventional Commits	commit_message_pattern block with regex ^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9\\-]+\))?(!)?: .+\$
6	Linear history always	required_linear_history = true in org_branch_protection, no bypass

CODEOWNERS deliberately not in this PR

An earlier commit attempt added .github/CODEOWNERS with an owner login baked in. That violates the no-identities-in-code rule the PR also codifies in AGENTS.md. CODEOWNERS files for every dryvist repo (this one included) land in a follow-up PR via github_repository_file with the owner identity supplied as a Terraform variable — the repo source tree stays identity-free.

Conventions added to AGENTS.md

• No identities anywhere except providers.tf owner — no usernames, account logins, email addresses, or person-tied identifiers in any source file. CODEOWNERS materialized at apply time from a variable.
• Cost policy — never apply a policy or enable a feature that costs money unless the PR body declares the cost and the operator approves it. Includes a free / GHAS-gated / metered / subscription matrix as of 2026-05 with sources:
  • GitHub Advanced Security pricing — $30/committer/month Code Security, $19 Secret Protection (private repos only; public repos free)
  • 2026 GitHub Actions pricing changes — self-hosted runners on private repos incur a new $0.002/min platform fee as of 2026-03-01
• Per-PR "Cost impact" checklist for any change touching Actions, GHAS, Codespaces, Copilot, or org/repo settings affecting those

Cost impact

Free. All ruleset rules are native GitHub features at zero cost on any plan. The markdown_lint workflow runs on Actions; public repos are unlimited free, private repos count against the Team-plan free tier (3000 min/month GitHub-hosted; $0.002/min self-hosted on private as of 2026-03-01). No GHAS feature flipped on by this PR.

Apply (requires gh-claude-org-admin)

```bash
gh-claude-org-admin
tofu init -backend-config=...
tofu apply
```

Apply will:

1. Adopt rulesets 15555419 + 17062292 into Terraform state
2. Rename them to org-branch-protection / org-markdown-lint
3. Add commit_message_pattern rule to the imported branch-protection ruleset
4. Create new org-review-gate ruleset
5. Move markdown_lint enforcement from disabled → evaluate

Test plan

• `tofu init -backend=false && tofu validate` — green
• `pre-commit run --all-files` — green
• Commit GPG-signed
• All identities purged from source tree (verified via grep)
• Apply with `gh-claude-org-admin` and confirm imports succeed without resource churn
• Sacrificial test: push commit with non-Conventional message on a throwaway branch → rejected
• Sacrificial test: open PR from a bot account → 1 reviewer required
• Sacrificial test: open PR from operator account → can self-merge after thread resolution