feat: add Phase 7 — Branch Protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase7_teardown.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase7_teardown.sh — Remove branch protection rules from all repos
+# Deletes the PROTECTED_BRANCH protection rule via API.
+# Safe to run if protection rules have already been removed.
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+
+load_env
+require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
+             REPO_1_NAME REPO_2_NAME REPO_3_NAME PROTECTED_BRANCH
+
+log_warn "=== Phase 7 Teardown: Branch Protection ==="
+
+REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
+
+printf 'This will remove branch protection for "%s" on all repos. Continue? [y/N] ' "$PROTECTED_BRANCH"
+read -r confirm
+if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+  log_info "Teardown cancelled"
+  exit 0
+fi
+
+for repo in "${REPOS[@]}"; do
+  if gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1; then
+    gitea_api DELETE "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1 || true
+    log_success "Removed branch protection from ${repo}"
+  else
+    log_info "No branch protection on ${repo} — already clean"
+  fi
+done
+
+log_success "Phase 7 teardown complete"