fix(apply-repo-settings): backfill GitHub's implicit pull_request defaults before diffing

[nsheaps-oura]

Summary

• Follow-up to fix(apply-repo-settings): normalize bypass_actors order before diffing #95 (merged) — fixes the second, separately-flagged false-positive from that PR's description: GitHub backfills allowed_merge_methods and required_reviewers on pull_request-type rules with implicit defaults that settings.yml never explicitly sets, causing a permanent false "needs update" even when nothing is actually misconfigured.

Research (not a guess, per the ask)

Checked both potential sources of a "documented default" and found neither declares one:

• GitHub's OpenAPI schema (repository-rule-pull-request) has no default: key on allowed_merge_methods or required_reviewers.
• The REST API reference docs state no default behavior for either field when omitted.

Since there's no citable documented default, verified the actual runtime behavior empirically, across two independent repos, rather than assume it:

• nsheaps/greasemonkey-scripts and nsheaps/.github both have allow_merge_commit: false at the repository level (merge commits disabled) — yet both repos' live require-pr ruleset still returns allowed_merge_methods: ["merge", "squash", "rebase"] (all three, including the disabled one). This rules out the plausible-but-wrong guess that the default mirrors the repo's own merge-method settings — it's a fixed, independent default.
• Both repos also return required_reviewers: [] when unset.

Fix

Backfill allowed_merge_methods → ["merge","squash","rebase"] and required_reviewers → [] on pull_request-type rules, on both current_norm and desired_norm, only when the field is actually absent (// default) — so a real, explicit value on either side is never overwritten.

Test plan

• bash -n + shellcheck — clean.
• Reproduced the exact real-world false positive (current has both fields backfilled, desired omits them, matching the actual org-settings.yaml template + live API shape) — confirms current_norm == desired_norm after the fix.
• Synthetic genuine-drift case: desired explicitly restricts allowed_merge_methods to ["squash"] while current still has all three — confirms this still registers as drift (fix doesn't mask a real future restriction).
• Synthetic genuine-drift case: desired explicitly configures required_reviewers while current is still empty — confirms this still registers as drift.
• Non-pull_request rule types (e.g. deletion, non_fast_forward) pass through the filter unmodified, no crash on rules without a parameters block.
• Not yet exercised end-to-end against a live repo (same caveat as fix(apply-repo-settings): normalize bypass_actors order before diffing #95 — this action is only invoked via @main by consumers).

🤖 Generated with Claude Code