Apply GitHub change-control rulesets

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331, §3 A7 and risk P7) of epic 5329 — read them with `task_read` / `task_read_artifact`. Binding decision (verbatim): "D1 ... Execute every step except an approval act." Credentials: `users/roman@gmind.tech/github_admin` (GitHub admin API, used by `tools/github_settings.py apply`) and `jaah/system/bootstrap-admin` (evidence filing); confirm with `task_credential_list` first — `infra/github/README.md:37` says no agent holds the admin credential, so if it is absent that is a BLOCKER ask. Evidence filing: `tools/evidence_store.py` CLI with `EVIDENCE_BUCKET=jaah-main-evidence-366008913850`; Object Lock — permanent; dry-run first. ## Requirement (verbatim from PRD) "### R2 ... **AC2.1** The fleet and reviewer machine users exist (OA-1), with logins recorded in the instance file. The live `protect-develop` and `protect-master` rulesets match `infra/github/rulesets/`: at least one approval; code-owner review on CODEOWNERS paths; the required checks declared there. *Verify:* `jaah-forge api get repos/jaah-ai/jaah/rulesets/<id>` shows `required_approving_review_count >= 1`, `require_code_owner_review: true` and the declared contexts. Then `tools/github_settings.py diff --ci` exits 0. A test PR with no approval cannot merge." This child owns AC2.1's ruleset half (the machine users are the Dependabot/machine-users child's). ## Scope and approach (from the settled architecture) Architecture A7 step 4, deliberately sequenced after prod verification: `.github/CODEOWNERS` covers `/infra/`, `/.github/`, `/docs/policies/`, `/docs/compliance/`, `/tools/evidence_store.py`, auth/MFA/migrations — once `require_code_owner_review` is live, any PR touching them needs Roman's own approval, so the other build PRs of this epic merge first. - Preconditions (all three, else do NOT apply — it halts the fleet; settle naming the remainder for the close-out child's R16 list): (1) the reviewer machine user exists and a live develop PR shows `review-lane` + the reviewer's approval; (2) the console's Git Access pushes as the FLEET machine user — a recent fleet PR's author/pusher is the fleet login, not `ruzhukov` (otherwise `require_last_push_approval` + code-owner review leave Roman unable to approve); (3) `promotion-provenance` (required by `infra/github/rulesets/master.json`) reported on a develop→master PR — the promotion PR the gate child got merged. - Run `tools/github_settings.py apply --yes`, then `diff --ci`, then `export` (files to `github-settings/`). - Prove an unapproved test PR cannot merge (open it, observe merge blocked, close it, delete its branch). - Do NOT flip `drift_enforced` or edit `infra/github/README.md` here: both ride the readiness close-out child's PR so Roman gives ONE code-owner approval, not two. This child opens no PR (besides the throwaway test PR). - Settle `no_pr` / `remediated` with the evidence. Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: Do not edit the ruleset JSON to weaken it (no lowering approvals/checks). No `gh` — `jaah-forge` and `tools/github_settings.py` only. Leave no test PR open or branch behind. Done means: - AC2.1 — oracle: `jaah-forge api get repos/jaah-ai/jaah/rulesets/<id>` for `protect-develop` and `protect-master` shows `required_approving_review_count: 1`, `require_code_owner_review: true`, and contexts `gate` + `review-lane` (develop) / the `master.json` contexts — cited; `tools/github_settings.py diff --ci` exit 0 cited. - Unapproved PR blocked — oracle: `jaah-forge pr view <n>` shows the merge blocked by the review requirement; PR closed afterwards. - Evidence — oracle: the `github-settings/<date>/…` `s3://` URI printed. - Preconditions — oracle: each of the three cited (PR numbers / check-run ids).

Rulesets NOT applied: all 3 preconditions unmet (no reviewer/fleet machine users, no review-lane, no promotion-provenance). Applying would halt the fleet. Remainder for close-out R16: owner creates machine users + promotes, then re-run apply. No PR.