revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset

deploy/organization-rulesets/README.md

@@ -33,7 +33,6 @@ verb — e.g. `require-pull-request.yaml`). Repo-scoped rulesets live next door
 |---|---|---|
 | 10 `OrganizationRuleset` files | the 10 org rulesets below | Observe (read-only import) |
 | `protect-release-tags.yaml` | **Protect release tags** (net-new) | Managed (Create) — block tag delete + force-move + require `v<semver>` |
-| `require-status-checks-coderabbit-review.yaml` | **Require status checks to pass - CodeRabbit** (net-new) | Managed (Create) — require the `CodeRabbit` status check on the default branch of every repo |
 | (in `../repository-rulesets/`) `require-merge-queue-on-platform.yaml` | `platform` "Require merge queue" | Observe (read-only import) |
 
 The 10 imported org rulesets: Block force pushes · Require a pull request before
@@ -73,6 +72,18 @@ These are tracked for re-adoption as the provider gains support in
 [#69](https://github.com/devantler-tech/.github/issues/69) (`roadmap`). Re-home each
 here Observe-first once expressible.
 
+> **⚠️ `required_status_checks` rulesets are expressible but NOT provider-creatable.**
+> A required-status-check org ruleset (requiring the `CodeRabbit` check) was added in
+> [#74](https://github.com/devantler-tech/.github/pull/74) and **reverted** — on create the
+> provider **panics**: `terraform-provider-github` v6.6.0 (`respository_rules_utils.go:343`)
+> does `requiredStatusMap["do_not_enforce_on_create"].(bool)`, but `provider-upjet-github`
+> v0.19.1's CRD doesn't expose `doNotEnforceOnCreate`, so the key is `nil` → `nil.(bool)`
+> panics. The field can't be set from the CR to avoid it, and v0.19.1 is the latest release.
+> So **"Require status checks to pass"** (and any CodeRabbit equivalent) must stay
+> **UI-created + Observe-imported** until the provider is fixed; that is also why the
+> `require-status-checks.yaml` import here is Observe-only. Tracked in
+> [#69](https://github.com/devantler-tech/.github/issues/69).
+
 ## Push / tag / Actions-policy considerations
 
 - **Push rulesets** — none exist, and **not adoptable**: the provider supports

deploy/organization-rulesets/kustomization.yaml

@@ -1,7 +1,6 @@
 # `OrganizationRuleset` resources — one per file, named after the rule (an active verb).
-# 10 existing org rulesets are adopted Observe-first (read-only) and 2 net-new rulesets
-# (1 tag, 1 branch) are managed (Create). The 10 org rulesets the provider cannot express
-# remain UI-managed —
+# 10 existing org rulesets are adopted Observe-first (read-only) and 1 net-new tag ruleset
+# is managed (Create). The 10 org rulesets the provider cannot express remain UI-managed —
 # see ./README.md for the importability matrix and the push/tag/Actions-policy analysis.
 # Repo-scoped rulesets live in ../repository-rulesets/. Included by ../kustomization.yaml.
 apiVersion: kustomize.config.k8s.io/v1beta1
@@ -20,4 +19,3 @@ resources:
   - require-workflows-dependency-review.yaml
   # Net-new, managed (Create).
   - protect-release-tags.yaml
-  - require-status-checks-coderabbit-review.yaml

deploy/organization-rulesets/protect-release-tags.yaml

@@ -1,5 +1,4 @@
-# Protect release tags — a net-new, actually-managed org ruleset (see also
-# require-status-checks-coderabbit-review.yaml; the rest in this directory are Observe-only imports).
+# Protect release tags — the ONE net-new, actually-managed ruleset in deploy/rulesets/.
 #
 # The org ships every product by tagging a `v*` release (each repo's cd.yaml triggers
 # on `v*`), yet had NO tag ruleset — release tags could be deleted or force-moved.