reconcile reports rulesets as applied when nothing was written; branch-protection cycle crashes on a user-owned repo

[lex00]

What happened

With @intentius/github-warden@0.6.1 from npm, reconciling one private, user-owned repo:

• reconcile --cycles rulesets --mode apply prints Applied: 1, but no ruleset is created. GET /repos/{owner}/{repo}/rulesets stays empty afterwards.
• reconcile --cycles branch-protection crashes with Cannot read properties of undefined (reading 'repos').

The token belonged to a collaborator with push but not admin rights, so the API calls should have failed. The problem is that warden reported success. The GitHub plan may also not enforce rulesets on private repos. Either way, "Applied" should only be printed when the write actually succeeded.

Config used

orgs:
  <user>:
    repos:
      <repo>:
        rulesets:
          - name: main-requires-test
            target: branch
            enforcement: active
            conditions: { ref_name: { include: [refs/heads/main] } }
            rules:
              - type: required_status_checks
                parameters:
                  strict_required_status_checks_policy: false
                  required_status_checks: [{ context: test }]

Expected

• A failed write (403, 404 or 422, including "upgrade required" for rulesets on private repos) is reported as a failure with the API's message, and the exit code is non-zero.
• After apply, a re-read confirms the change or reports drift.
• The branch-protection cycle handles a user-owned repo under orgs: (or the docs say which key user repos go under), without crashing.

Acceptance criteria

• The rulesets cycle surfaces API errors and never counts an unconfirmed write as applied.
• The branch-protection cycle no longer throws on this config shape, and a test covers it.
• The docs cover user-owned (not org) repos and the permission and plan requirements.