fix(branch-protection-sync): exit-code state detection + preserve existing checks

[POWERFULMOVES]

Follow-up to #1760. Found three bugs by verifying the dry-run (run 27227095327) before any fleet-wide apply — none would have surfaced in dry-run alone:

1. State detection broken — gh api prints the 404 error JSON to stdout, so testing output-emptiness mis-read every branch as "protected" → only_unprotected would skip everything. Now branches on the gh api exit code.
2. Regression risk — the policy nulled required_status_checks unconditionally; a broad apply would wipe the checks on the 3 forks that actually gate on CI (Agent-Zero=3, Archon=2, DoX=2). Now preserves existing required checks; naked branches stay null.
3. Heredoc bug — policy()'s <<JSON terminator was indented (needs col-0), so it would never terminate on the first real apply (dry-run returns before calling it, so it was latent). Rebuilt with jq — always-valid JSON, $rsc injected as real JSON.

Plus: private repos that 403 with "Upgrade to GitHub Pro" are now skipped + counted (not mis-blamed on a missing admin grant — PMOVES-space-agent).

Verified locally against the live API before pushing:

Fork	Detected	Preserved checks
supabase	protected[checks=0]	null
Agent-Zero	protected[checks=3]	{"contexts":["audit","lint","security-scan"]} ✅
tensorzero	UNPROTECTED	null
space-agent	SKIP(needs-pro)	—

After merge: dry-run → apply only_unprotected=true to protect the ~33 naked forks (preserving the 3 good ones).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@POWERFULMOVES, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 44 minutes and 17 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 42adbc95-96be-42ac-b186-886ab5c1fe57

📥 Commits

Reviewing files that changed from the base of the PR and between a6ec3b8 and ff50ac5.

📒 Files selected for processing (1)

• .github/workflows/branch-protection-sync.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/branch-protection-state-detection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff50ac5399

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check stdout for Pro-only protection errors

Here grep only examines /tmp/bp_err, but this GET captures gh api stdout into cur and redirects only stderr; the new comment above also notes that gh api prints HTTP error JSON to stdout, and the gh api manual describes the command as printing the API response. For private repos whose 403 body contains “Upgrade to GitHub Pro” on stdout, this branch never matches, so dry-runs report them as UNPROTECTED and apply runs try the PUT and count a failure instead of the intended s skipped(needs-pro). Check cur as well, or capture stdout and stderr into the same buffer before falling through.

Useful? React with 👍 / 👎.