Enable the Issue Lifecycle required check after a green observation window #460

Parent

#455

What to build

After the lifecycle auditor and its observational workflow are merged and the reconciled live repository produces a green read-only run, add the stable Issue Lifecycle check to default-branch protection and independently read back the effective protection rule. This issue changes repository governance settings only.

Acceptance criteria

• The exact merged auditor and workflow revisions plus one successful live-repository audit run are recorded before protection changes.
• Existing required checks, conversation-resolution policy, admin enforcement, branch deletion behavior, and automatic-issue-closing UI state are captured before mutation.
• Issue Lifecycle is added without removing or weakening any existing required check or protection rule.
• An independent API readback proves the effective required-check set and enforcement state.
• A representative valid PR remains mergeable after the check succeeds, while a fixture-invalid relationship fails the check.
• Rollback instructions remove only Issue Lifecycle and restore the exact previous protection document.

Blocked by

#459, #467, and #480.

Runtime control

• Named controller: Codex /root under the repository owner's authorization in the initiating task.
• Target: default-branch protection for proerror77/monday only.
• Stop rule: do not mutate branch protection until the merged auditor, merged workflow, and post-migration live run are green.
• Rollback: restore the preflight branch-protection document exactly.

Automatic-close setting readback method

GitHub's documented REST and GraphQL APIs do not expose this toggle. The named controller records the authenticated Settings UI value during preflight and readback. This rollout does not change that setting implicitly; branch-protection state remains independently proven through the API.