Setup repo

Four parts, each idempotent — skip what already holds. Pattern source: Habits-Family/habits (v2-rebuild). Run after the pre-commit stack is chosen (/setup-pre-commit or the repo's own) — part 2 wires into it.

1. GitHub settings

Give the default branch (git symbolic-ref --short refs/remotes/origin/HEAD | sed 's|^origin/||', fallback main) a ruleset refusing force pushes and deletions. Skip when gh api repos/{owner}/{repo}/rulesets --jq '.[].name' already lists protect-trunk:

gh api repos/{owner}/{repo}/rulesets --input - <<'JSON'
{
  "name": "protect-trunk",
  "target": "branch",
  "enforcement": "active",
  "conditions": { "ref_name": { "include": ["~DEFAULT_BRANCH"], "exclude": [] } },
  "rules": [{ "type": "deletion" }, { "type": "non_fast_forward" }]
}
JSON