GitHub branch protection needs a paid plan on private repos

Creating a ruleset or branch protection rule via gh api --method POST repos/OWNER/REPO/rulesets fails with 403 "Upgrade to GitHub Pro or make this repository public to enable this feature" when the owning org is on the free plan and the repo is private. Rulesets are free on PUBLIC repos only; private repos need Team/Pro. Check with gh api orgs/ORG --jq .plan.name before promising a PR-gated workflow — the failure surfaces only at ruleset-creation time, after the repo exists and has been pushed. If a review gate is the point (e.g. stopping autonomous agents from landing unreviewed work), do not silently fall back to convention-only enforcement: an unenforced gate looks identical in the docs and does not do the job.