Remove classic branch protection requiring 'Analyze (python)' — blocks PRs CodeQL skips; standard requires rulesets only #527

Problem

main on this repo has classic branch protection requiring the status check Analyze (python), in addition to the org ruleset. A PR that CodeQL does not analyze can never satisfy it, so the PR is permanently BLOCKED even when everything else is green.

Evidence

• GET /repos/petry-projects/TalkTerm/branches/main/protection/required_status_checks returns {"strict": true, "contexts": ["Analyze (python)"]}.
• The ruleset on main already requires CodeQL, SonarCloud, agent-shield / AgentShield and dependency-audit / Detect ecosystems.
• Dependabot PR chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 #249 (actions/checkout 6.0.2 -> 7.0.1) had CodeQL produce no run on either head commit (93fa9fea, 69b4a645). Analyze (python) never reported. The PR sat BLOCKED for about 15 hours with CI green and approvals from petry-projects-dependabot-automrg and donpetry-bot. It was admin-merged on 2026-10-02.
• CodeQL default setup itself is healthy (configured, actions + python, standard runner, last scheduled run succeeded). Other recent PRs in this repo and org got both Analyze checks, so this is not a setup fault.
• Of the repos checked on 2026-10-02, this is the only one with classic protection requiring an Analyze (...) context.

Why this violates the standard

standards/github-settings.md says repositories MUST use rulesets on the default branch and that classic branch protection is deprecated. It also says GitHub-managed CodeQL produces a check named CodeQL, not Analyze (...), and that requiring a check name a job does not always produce permanently blocks merges.

Fix

1. Remove the classic protection on main (or at minimum its required Analyze (python) context). The ruleset already enforces CodeQL.
2. If any classic rule is still needed, migrate it into the ruleset.
3. Re-run the settings/compliance audit to confirm no drift.

Acceptance criteria

• GET .../branches/main/protection returns 404 (no classic protection), or no Analyze (...) context is required.
• The ruleset still requires CodeQL, SonarCloud, agent-shield / AgentShield and dependency-audit / Detect ecosystems.
• A Dependabot actions-only PR can reach mergeable without admin override.