Lock down a GitHub repository

Protect a repo's default branch with a GitHub repository ruleset and turn on auto-delete of merged branches. The bundled scripts/lockdown.sh does the work through the gh CLI; it is idempotent (upserts one ruleset named github-lockdown). It never deletes branches or history, and never touches any ruleset other than its own github-lockdown ruleset, which it creates or updates in place.

When this applies

• The target is a GitHub repo and you have (or can get) the admin role on it.
• gh is installed and authenticated (gh auth login) and jq is installed.

If the user is not an admin, stop and tell them an admin must run this — do not invent a workaround.

Defaults (the fast path)

The standard lockdown, applied with no flags: