🤖 Generated by the Daily AI Assistant

What & why

The org's GitHub rulesets were the last major piece of org config still managed
only in the UI. This brings them into deploy/ as Crossplane managed resources
(provider-upjet-github), reconciled by the platform github-config tenant like
repositories/, teams/, and labels/ — and adds the tag protection the org
lacked despite releasing on v* tags.

The platform side was already wired for this (the organizationrulesets +
repositoryrulesets MRDs are activated and the tenant RBAC already covers both API
groups); only the manifests were missing.

What's in this PR

Imports are Observe-first (managementPolicies: ["Observe"]): read-only, zero
behaviour change, zero revert risk — identical to how repos/teams were adopted. Delete
is omitted everywhere, so nothing here can ever delete a real ruleset. external-name binds
each to the existing ruleset (<id> for org, <repo>:<id> for repo).

The one write is Protect release tags: an org tag ruleset over ~ALL repos/tags
that blocks tag deletion + force-move and requires v<semver> names. Creating new
release tags is unaffected; only tampering is blocked.

⚠️ Tier caveat on the tag name pattern: docs flag tag_name_pattern as
"enterprise only" and this org is on the team plan — but it already runs active
org-level branch_name_pattern + commit_message_pattern rulesets, so pattern rules
demonstrably work here. If GitHub nonetheless rejects the ruleset on apply, drop just the
tagNamePattern block (header comment explains) — deletion + nonFastForward still
deliver immutable tags with no tier requirement.

Push / tag / Actions policies (as requested)

• Push — no push rulesets exist and none are adoptable (the provider lacks the
  push-file rule types). Documented; tracked in Adopt remaining rulesets declaratively as provider-upjet-github gains support (10 org rulesets + push + Actions policies) #69.
• Tag — added here (above).
• Actions — the new workflow execution protections
  (actor/event allow-lists via custom-property-scoped org rulesets) aren't adoptable yet
  (new rule types absent; relies on repository_property scoping the provider lacks).
  Documented; tracked in Adopt remaining rulesets declaratively as provider-upjet-github gains support (10 org rulesets + push + Actions policies) #69.

Provider gap — 10 of 22 stay UI-managed

provider-upjet-github v0.19.1 can't express repository_property conditions,
code_quality/copilot_code_review rules, or repository-target rulesets, so 10 org
rulesets remain UI-managed (fully active meanwhile). Full matrix in
deploy/rulesets/README.md; re-adoption tracked in #69.

Validation

• kubectl kustomize deploy/ builds (13 ruleset resources emitted).
• Every manifest passes kubectl apply --dry-run=server against the live prod CRDs.

Rollout

Draft until you promote it. On merge + a v* release tag of this repo, the artifact
republishes and Crossplane reconciles: the 12 imports become Ready with
status.atProvider populated, and Protect release tags is created. Promoting an import
past Observe to full management is a deliberate, separately-validated follow-up (backfill
forProvider from observed state first — the round-trip is lossy).