[JuggyBob]

Fixes the repo's own automation

Three defects that only surfaced once the workflows actually ran. All three are
fixed here.

1. Branch protection could not be applied

The documented command used PUT on the rulesets collection. PUT only exists
on /rulesets/{id} for updating an existing ruleset; creating one is POST, and
PUT on the collection returns a bare 404 Not Found.

Two further shape errors in the JSON, caught by applying it for real:

• conditions must be an object, not an array
  (*is not of type 'object'*)
• "integration_id": null is not an acceptable value; the key must be omitted
  entirely so GitHub matches the check by context name

Applied and read back from the live API:

rules: deletion, non_fast_forward, pull_request, required_status_checks
required checks : CI / Build and test   |   Analyze
approvals       : 1
stale dismissed : True
code owner rev  : True
threads resolved: True
up to date      : True
merge methods   : merge, squash

2 and 3. CodeQL failed on every run

Two separate causes, and the first one sent me down the wrong path.

Wrong step order. The workflow ran analyze before Build. CodeQL extracts
source through the compiler's call graph, so it has to watch a real compile.

The real cause. Fixing the order alone did not help. The actual problem was
that setup-gradle restores the Gradle build cache, which served
compileDebugKotlin as FROM-CACHE. A cached task does not run, so the Kotlin
compiler never started and the tracer captured nothing — while the build still
printed BUILD SUCCESSFUL, which is what makes it so hard to spot:

> Task :app:generateDebugBuildConfig FROM-CACHE
> Task :app:extractDeepLinksDebug FROM-CACHE
> Task :app:dexBuilderDebug FROM-CACHE
> Task :app:assembleDebug
BUILD SUCCESSFUL in 21s

assembleDebug now runs with --no-build-cache in this job only.

Also added the missing security-events: write permission, without which the
action cannot upload results and reports failure even when the analysis itself
succeeded.

Verification

• Branch ruleset — applied via the API, read back field by field (above).
• CI / Build and test — pass. 334 tests, 26 suites, 0 failures, lint clean,
  both APKs built.
• Analyze (java-kotlin) — pass, 0 code-scanning alerts.

Note

This PR is also the ruleset's own first test. The direct git push to main
carrying fix #1 was rejected with GH013, so the change was routed through a
pull request like any other.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.