GitHub settings cache prevents retry after branch protection skips a missing branch

## Problem

When `github.protected_branches` includes a branch that does not yet exist, branch protection handling catches the 404 and continues. The enclosing GitHub feature then caches the complete GitHub YAML. Later default-branch pushes with unchanged GitHub settings return early, so protection is never retried after the branch is created.

This can affect generated branches such as `asf-site`.

## Reproduction

1. On the default branch, configure:

```yaml
github:
protected_branches:
main: {}
asf-site: {}
```

while only `main` exists.
2. Push the configuration.
3. Create `asf-site` afterward.
4. Push another commit to the default branch without changing the `github:` block.
5. Observe that `asf-site` remains unprotected.

The branch protection directive skips the missing branch:
https://github.com/apache/infrastructure-asfyaml/blob/main/asfyaml/feature/github/branch_protection.py#L119-L124

The outer GitHub feature then caches the YAML and skips later unchanged runs:
https://github.com/apache/infrastructure-asfyaml/blob/main/asfyaml/feature/github/__init__.py#L221-L232
https://github.com/apache/infrastructure-asfyaml/blob/main/asfyaml/feature/github/__init__.py#L254-L257

We observed this in `apache/asyncband-site`: the configuration was applied while only `main` existed, and the deployment workflow created `asf-site` 17 seconds later. The branch subsequently remained unprotected despite being declared in `.asf.yaml`.

## Expected behavior

A retryable partial failure should not permanently mark the whole GitHub configuration as reconciled. The missing branch should be retried after it appears, or the pre-existing-branch requirement should be explicit and generated/future branches should be directed to rulesets.

## Possible approaches

- Avoid updating the GitHub settings cache when a directive reports a retryable partial failure.
- Track pending directive/branch reconciliation separately and retry only those entries.
- Reconcile protected branches on branch creation.
- Document the current behavior and recommend rulesets for refs that may be created later.

Not caching the entire GitHub config after any partial failure is the smallest fix, but more granular pending state may avoid rerunning unrelated settings on every push.

Start by reading asfyaml/feature/github/branch_protection.py around the missing-branch 404 handling, then inspect asfyaml/feature/github/__init__.py around the GitHub YAML cache checks. Trace how a partial failure is reported and how the cache is updated. Done means a branch declared before it exists is retried after creation and becomes protected on a later default-branch push, without regressing other GitHub settings.

Written by the indexing model from the issue text.