fix(ruleset): preserve external pull parameters

[rldyourmnd]

Outcome

Make pull-request ruleset updates lossless while GDS owns merge controls.

• request mutation replaces typed owned fields
• required_reviewers, dismissal_restriction, and future external parameters are preserved
• expected postcondition carries the same external parameters
• provider read-back can now verify the exact state instead of marking a successful GitHub update partial

This follows live evidence where GitHub accepted the desired merge controls but GDS postcondition lost external defaults.

Evidence

• provider mutation regression
• ruleset expected-state regression
• app/provider/ruleset suites
• quick Go validation
• portable synthetic fixtures only