Add bypass_actors variable; allow Admin role to bypass ruleset

Mirrors the addition in JMR-dev/gh-repo-bootstrap. Solo-maintainer
configuration so PRs can be merged without a second approver.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

infra/github/main.tf

@@ -15,6 +15,15 @@ resource "github_repository_ruleset" "default_branch" {
     }
   }
 
+  dynamic "bypass_actors" {
+    for_each = var.bypass_actors
+    content {
+      actor_id    = bypass_actors.value.actor_id
+      actor_type  = bypass_actors.value.actor_type
+      bypass_mode = bypass_actors.value.bypass_mode
+    }
+  }
+
   rules {
     deletion            = true
     non_fast_forward    = true

infra/github/variables.tf

@@ -37,3 +37,20 @@ variable "ruleset_name" {
   type        = string
   default     = "default-branch-protection"
 }
+
+variable "bypass_actors" {
+  description = <<-EOT
+    Actors permitted to bypass the ruleset. Each entry needs:
+      - actor_id: numeric ID (for built-in repo roles: 1=read, 2=triage,
+        3=write, 4=maintain, 5=admin)
+      - actor_type: one of RepositoryRole, Team, Integration,
+        OrganizationAdmin, DeployKey
+      - bypass_mode: "always" or "pull_request"
+  EOT
+  type = list(object({
+    actor_id    = number
+    actor_type  = string
+    bypass_mode = string
+  }))
+  default = []
+}