chore: manage GitHub merge requirements with Terraform

[SpencerC]

What & why

The default branch's ruleset was disabled and referenced obsolete Bazel 8 check names, so the current CI matrix did not gate merges. Adopt the existing repository and Main ruleset into Terraform, enable the ruleset without bypass actors, and require all 12 test jobs, four example jobs, docs, pre-commit, and conclusion. Required matrix check names are derived from the CI workflow.

Enable GitHub's automatic deletion of merged PR head branches. Configure repository-local fetch.prune during Codex setup and document the same command for other clones, so fetches remove stale remote-tracking references. Local working branches and worktrees are retained.

The final CI gate now requires success from every prerequisite; failures, cancellations, skipped jobs, and missing results fail the gate. An e2e regression covers those cases. Terraform runs through a pinned Bazel-provided CLI, with a provider lockfile and state stored in the clone's shared Git directory so it survives worktree removal.

The settings were applied to GitHub after reviewing a plan with two imports, two in-place updates, and no creation or destruction. A follow-up plan reports no changes. The 19 required contexts match the jobs in the referenced CI run.

Checklist

• bazel test //flutter/tests:all_tests //docs:update_tests passes (28 tests)
• cd e2e/smoke && bazel test //:integration_tests passes (24 targets)
• Ran bazel run //docs:update if any rule/macro API changed — not applicable; no rule/macro API changed, and the explicit docs gate passes
• pre-commit run --all-files is clean; also ran Bazel buildifier and Terraform fmt/validate
• Updated docs/README for user-facing changes (contributor guide and Terraform administration guide)