fix(bootstrap): stop applying classic branch protection

[jdfalk]

Why

falkcorp manages branch rules with org-wide rulesets. The bootstrap-repo skill was also installing per-repo classic branch protection, which is actively harmful:

1. Classic protection has no bypass_actors list. Rulesets can exempt automation; classic protection can exempt no one. It blocked the Sync from Template bot from pushing to main in 15 gha-* repos for ~4 months:

   remote: error: GH006: Protected branch update failed for refs/heads/main.
   remote: - Changes must be made through a pull request.
   

   Adding bypass actors to the org rulesets did nothing — classic protection does not consult them. Deleting it fixed the sync on the next run.

2. The required contexts could never be satisfied. discover_status_checks.py collected job IDs, but GitHub reports checks by display name:

   required context (job id)	actually reported
   test-with-config	Test With Valid Config
   validate	Validate Action

   Those contexts sat Expected forever, so every PR was blocked — 34 Dependabot PRs unmergeable, some for 6+ months.

3. Conditional jobs became required checks. set-auto-merge is gated on if: contains(labels, 'auto-merge'). Unlabelled PRs skip it, and a skipped required check never satisfies protection. The auto-merge label did not exist in any repo.

What changed

• Deleted apply_branch_protection.sh and discover_status_checks.py
• Dropped --skip-protection from bootstrap_repo.sh
• Inverted verify_bootstrap.sh: the presence of classic protection is now reported as drift, with the removal command
• Removed the dead --repo-path arg from verify_bootstrap.sh and both call sites (it existed only to feed discover_status_checks.py)
• Rewrote references/branch-protection.md as a do-not-do-this rationale

Latent bug also fixed

The old check did PROTECTION=$(gh api ... || echo "") then tested -z. gh api prints HTTP error bodies to stdout, so a 404 still yields a non-empty string — the "no protection" case was undetectable. Now tests the exit status.

Verification

• bash -n + shellcheck -S warning clean on all scripts
• Verifier tested both branches against real repos, after shfmt reformatting:
  • repo without protection → ✓ No classic branch protection
  • protection temporarily re-added → ✗ classic branch protection is present, then removed again
• No dangling references to the deleted scripts remain

Rollout already applied

Classic protection removed from all 45 falkcorp repos (0 remain); configs backed up. The template-sync bot pushed successfully for the first time since 2026-04-25.