[TASK] Lower required approvals for .github/* changes

Type

Task

Scope

Multi-theme or Platform

Skillset

dev ops

Description

Context: branch protection for main currently requires the same approval count for every change, including CI workflow tweaks and Dependabot version bumps under .github/. That slows down low-risk iteration on things like workflow fixes and dependency updates, where a single reviewer is enough.

Proposal: lower the baseline required_approving_review_count and use the ruleset's required_reviewers parameter to claw back the extra approval for everything outside .github/**, configured via safe-settings in omf-github-terraform, the source of truth for this repo's rulesets.

[!NOTE]
required_reviewers is a beta field on the pull_request rule: a list of {file_patterns, minimum_approvals, reviewer} entries, each requiring extra approvals from a specific team when a PR touches matching files (fnmatch syntax, ! negates). It's additive on top of required_approving_review_count, not a way to lower that count for a subset of paths directly. Inverting the baseline gets the same effect: drop the repo-wide count to 1, then require a second approval from a core-review team for every path except .github/**. Net result: 1 approval for .github/*-only PRs, 2 for everything else, same as today.

The extra-reviews ruleset in schema.yml already has an unused required_reviewers: [] slot, so this is a config change, not new plumbing:

# omf-github-terraform: .github/repos/schema.yml
- name: extra-reviews
  target: branch
  enforcement: active
  conditions:
    ref_name:
      exclude: []
      include:
      - ~DEFAULT_BRANCH
      - refs/heads/vnext
  rules:
  - type: pull_request
    parameters:
      required_approving_review_count: 1  # was 2
      dismiss_stale_reviews_on_push: true
      required_reviewers:
      - file_patterns:
        - "*"
        - "!.github/**"
        minimum_approvals: 1
        reviewer:
          id: 14774378 # omf-eng-ops, already a schema collaborator
          type: Team
      require_code_owner_review: false
      dismissal_restriction:
        enabled: false
        allowed_actors: []
      require_last_push_approval: false
      required_review_thread_resolution: true
  # required_status_checks unchanged