Reconciler refinement: add :fix_settings action class (BranchProtection/CodeReview)

[hyperpolymath]

Refs #260 / #263 (do not auto-close).

Surfaced by the natsci-studio live calibration. BranchProtectionID, CodeReviewID (and similar repo-configuration findings) are currently classified :open_escalate — correct (never silently dropped) but suboptimal: they are settings-actionable via the GitHub API (enable branch protection, require reviews), not code fixes and not non-actionable.

Add a distinct :fix_settings lifecycle action: deterministic, safe, API-driven repo-config remediation, separate from code :fix and from :open_escalate. This is the "reform as patterns emerge" increment from the campaign (parent #260). natsci-studio dry-run evidence: alerts #1 BranchProtection, #3 CodeReview → currently escalate; should auto-remediate under full-auto policy.

[hyperpolymath]

Jointly closed by explicit maintainer agreement (2026-05-17). Implemented in PR #271 (:fix_settings action class — BranchProtection/CodeReview, :full_auto/--conservative policy, idempotent branch-protection PUT; +3 tests, suite 809/809). #271 has squash auto-merge enabled and lands on CI-green. Refs #260 #263.