Rulesets using `{{EXTERNALLY_DEFINED}}` report "Update Ruleset" in every dry run

A ruleset that uses `{{EXTERNALLY_DEFINED}}` in `required_status_checks` (support added by #741) shows up as "Update Ruleset" in every dry-run/PR check, even when nothing differs from what's on GitHub.

The cause is an ordering problem in `lib/plugins/rulesets.js`: `changed()` runs `mergeDeep.compareDeep(existing, attrs)` on the raw config, where `attrs` still contains the literal `{{EXTERNALLY_DEFINED}}` string. `Overrides.removeOverrides` (which swaps the placeholder for the live GitHub value) is only called inside `update()` and `add()`, after the comparison already decided there's a change — and in nop mode the `update()` early-return means it's never called at all. The literal placeholder never equals the real status checks, so `hasChanges` is always true.

Two consequences:

- Every plan and PR comment shows a phantom "Update Ruleset" for these rulesets, which drowns out real changes.
- In apply mode, safe-settings issues a PUT on every sync for these rulesets, writing the same values back.

The branches plugin doesn't have this problem because it resolves overrides *inside* its comparison (`branches.js`, the `compareDeep` call passes the config through `Overrides.removeOverrides` first). The rulesets plugin needs the same treatment.

Start in lib/plugins/rulesets.js and compare its changed() logic with the compareDeep call in branches.js. Resolve {{EXTERNALLY_DEFINED}} before comparison so dry runs and apply-mode syncs do not report or perform updates when values match; verify the ruleset plan and PR output no longer show phantom changes.

Written by the indexing model from the issue text.