Branch-protection controls report 404 "Branch not protected" as WARN instead of FAIL

[justaugustus]

Description

For branch-protection controls, a definitive 404 "Branch not protected" from the GitHub API is a conclusive non-compliance, but darnit reports it as WARN ("could not automatically verify") rather than FAIL.

Steps to Reproduce

1. Point an audit at a repository whose default branch has no branch protection.
2. Run the live audit (authenticated gh).
3. Observe OSPS-AC-03.01, OSPS-AC-03.02, OSPS-QA-03.01, OSPS-QA-07.01.

Expected Behavior

A 404 "Branch not protected" is a definitive "not protected" and should resolve these controls to FAIL.

Actual Behavior

gh api /repos/<owner>/<repo>/branches/<branch>/protection returns:

404 "Branch not protected"

and the controls report WARN ("could not automatically verify - manual verification required") rather than FAIL.

Environment

• darnit version: main @ 86f9cfa
• Python version: 3.12 (uv-managed)
• OS: any (requires authenticated gh)

Additional Context

Distinct from #220 (closed), which fixed the crash (KeyError on allow_deletions / two_factor_requirement_enabled) — controls now degrade gracefully, but a definitive 404 still falls through to WARN instead of FAIL.

[justaugustus]

@mlieberman85 — Hmmm... thinking about the context/repo I filed this about, the repo does have a ruleset enabled (but there's no guarantee that the ruleset is "maximal").

One could conclude that the running task either:

• does not have access to investigate that endpoint, OR [maybe]
• classic branch protection API is not configured

...but I don't think this is exactly "conclusive non-compliance", given the existence of rulesets.