[imanimanyara]

Summary

• Merged branches are deleted by default. apply-rulesets.sh now sets GitHub's delete_branch_on_merge (--keep-branches opts out) before applying the rulesets. Because the branch ruleset requires passing checks to merge, a branch is deleted only after a successful, validated merge.
• scripts/prune-merged-branches.sh [CHECKOUT] [--apply] handles local copies. It deletes branches whose upstream is gone and whose tip is on the default branch, and removes their branch.<name> config. It never deletes the current, default, unmerged, squash-merged or never-pushed branch.
• scripts/reset-release-tags.py OWNER/REPO (--move vX.Y.Z | --fresh vX.Y.Z) --to SHA [--apply --confirm OWNER/REPO] handles a deliberate re-tag or fresh tag. It is a dry run by default and lists every tag, release and cached copy it contradicts. --apply requires the repository name typed back. The target SHA must be on the default branch. The tag ruleset is disabled only for the operation and re-enabled in finally. --move updates the ref in place, so the release stays published.
• Docs: docs/tools/repository-rulesets.md, README and CHANGELOG.

Tests

• 15 cases cover the tag reset against a fake gh.
• 3 cases cover pruning against a real repository with a bare remote.
• 3 new cases cover the wrapper.

Two were proven red: finally changed to else, and the not-merged reason dropped. Full suite: 1773 passed. Pint, PHPStan, ShellCheck and py_compile are clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.