[CI] Add ruleset JSON requiring lint-done on protected branches

[vmoens]

Summary

• Adds .github/rulesets/lint-required.json describing a branch ruleset that requires the lint-done aggregator (from .github/workflows/lint.yml) and the existing Meta CLA Check before merges into main / nightly / release/*.
• Adds .github/rulesets/README.md documenting how to apply / update / delete rulesets via gh api.

Why

There is currently nothing on the GitHub side that blocks merges when lint is red. The lint workflow runs and reports a red lint-done check, but:

• GET /repos/pytorch/rl/branches/main/protection returns 404 (no classic branch protection on main).
• The only existing ruleset is Meta CLA Enforcement, which is enforcement: "evaluate" (audit-only) and only requires Meta CLA Check.

So PRs with failing lint are mergeable today. This PR commits the source-of-truth JSON for an enforcement: active ruleset that fixes that.

Note: this PR does not by itself enforce anything

GitHub does not auto-apply files under .github/rulesets/. The JSON has to be POSTed via the API:

gh api -X POST repos/pytorch/rl/rulesets \
    --input .github/rulesets/lint-required.json

That gh api call is what flips the switch. The merge order between this PR and the API call doesn't matter — running the API call before merging is actually a nice live test that the new ruleset is wired up correctly.

Deliberate non-goals

• Does not require any test job (tests-cpu …, tests-gpu …, etc.). Lint only, for now — easy follow-up to add more required contexts.
• Does not add a pull_request rule (PR-required-before-merge) or non_fast_forward rule. Push behavior is unchanged.
• Does not touch the existing Meta CLA Enforcement ruleset.

Test plan

• Review the JSON for correctness against GitHub Rulesets API docs.
• Optionally run gh api -X POST repos/pytorch/rl/rulesets --input .github/rulesets/lint-required.json and verify with gh api repos/pytorch/rl/rulesets that the new ruleset appears with enforcement: "active".
• Confirm a PR with red lint-done is now blocked from merging (this very PR is a candidate, since it should pass lint).

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/rl/3690

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❗ 1 Active SEVs

There are 1 currently active SEVs. If your PR is affected, please view them below:

• Rolling out OSDC (ARC) runners on pull & trunk workflows in PyTorch main

❌ 1 New Failure

As of commit 0317813 with merge base adbf3d8 ():

NEW FAILURE - The following job has failed:

• Unit-tests on Linux / tests-cpu (3.11) / linux-job (gh)
  test/objectives/test_ddpg.py::TestDDPG::test_ddpg_prioritized_weights

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[github-actions]

$\color{#35bf28}\textsf{\Large✔\kern{0.2cm}\normalsize OK}$ Result of CPU Benchmark Tests

Total Benchmarks: 2. Improved: $\large\color{#35bf28}0$. Worsened: $\large\color{#d91a1a}0$.

Expand to view detailed results

Name	Max	Mean	Ops	Ops on Repo HEAD	Change
test_prioritized_sampler_sample_scale[1000000-cpu]	10.8555ms	10.3074ms	97.0176 Ops/s	97.0176 Ops/s	$0.00\%$
test_prioritized_sampler_sample_scale[10000000-cpu]	19.6160ms	19.2716ms	51.8899 Ops/s	51.8899 Ops/s	$0.00\%$

[github-actions]

$\color{#35bf28}\textsf{\Large✔\kern{0.2cm}\normalsize OK}$ Result of GPU Benchmark Tests

Total Benchmarks: 2. Improved: $\large\color{#35bf28}0$. Worsened: $\large\color{#d91a1a}0$.

Expand to view detailed results

Name	Max	Mean	Ops	Ops on Repo HEAD	Change
test_prioritized_sampler_sample_scale[1000000-cuda]	0.6937ms	0.4343ms	2.3026 KOps/s	2.3026 KOps/s	$0.00\%$
test_prioritized_sampler_sample_scale[10000000-cuda]	0.9613ms	0.9165ms	1.0911 KOps/s	1.0911 KOps/s	$0.00\%$