repo-protections

Applies the server-side gates that client-side hooks and good intentions can't replace. The failures this skill fixes: models suggest the legacy branch-protection UI instead of rulesets, don't know the gh api payloads, forget that CODEOWNERS does nothing until a ruleset requires code-owner review, and let bot PRs auto-merge.

When NOT to use

• SECURITY.md and other prose files → community-health.
• Fixing a vulnerability in code, rotating leaked credentials → incident work, not settings.
• Release pipelines / OIDC trusted publishing → out of scope here.
• CI workflow authoring → out of scope (naming required checks is in scope).

Workflow