ci(ospo): add three PR controls + admin emergency bypass

[jung-thomas]

OSPO compliance request (deadline 16 June 2026) flagged three missing controls on the main-protection ruleset. This PR adds them now under our own ruleset so the posture is explicit before central enforcement.

Findings addressed

• dismiss_stale_reviews_on_push: false → true
• require_last_push_approval: false → true
• required_review_thread_resolution: false → true

Bypass actor

Per project-owner request, also re-add a narrow bypass actor:

• bypass_actors: [] → RepositoryRole/5 (admin), bypass_mode: pull_request

This regresses OSPO Control 5 (PR #22 had removed the admin bypass entirely) and is documented in CLAUDE.md as an explicit owner decision. The bypass is pull_request mode only: admins still cannot force-push or delete main, only merge a PR without satisfying the new review/resolution checks during an emergency. Admins still need 1 approving review (the baseline required_approving_review_count: 1 has no per-actor override in this ruleset).

Using RepositoryRole/5 (well-known id for the admin role) instead of enumerating Users avoids drift as the admin roster changes (see docs/ospo-admin-demotion-draft.md, an active demotion effort) and avoids the Integration actor type that the SAP-samples org rejected with HTTP 422 in PR #23.

Apply order

Matches PR #22 / #23: this PR commits the JSON spec; the gh api PUT to import it server-side runs after merge. If the org rejects RepositoryRole/5 with HTTP 422, the fallback is to ship the three required controls with bypass_actors: [] — the 16 June deadline is binding; bypass is owner preference.

Supersedes

Closed #25 (ospo-branch-protection) which targeted only the bypass and missed the three required controls, and used the broader bypass_mode: always.

Plan

C:/Users/I809764/.claude/plans/dazzling-launching-frost.md

[qmacro]

I am unable to effectively review this as it is hard to understand what's being stated in the description. It is also difficult to match up anything in the description with what's actually changed in the commits.

[jung-thomas]

I am unable to effectively review this as it is hard to understand what's being stated in the description. It is also difficult to match up anything in the description with what's actually changed in the commits.

@qmacro
Please just approve this so I can merge the changes to the Pull Request Controls and add the admin bypass.