Bug: unprotect_reviews=true can leave branch protections disabled when push fails

[rafistrauss]

Summary

The action appears to remove required review protections before attempting the push, but if the push step fails, protections are not reliably re-established.

Reproduction

1. Configure CasperWA/push-protected with unprotect_reviews: true.
2. Target a branch protected with required reviews.
3. Trigger a run where the push will fail, for example due to permissions issues, a branch update race, or a rejected push.
4. Observe the branch protection state after the failure.

Expected behavior

Branch protections should always be restored, even when the push fails, including error or cancellation paths.

Suggested fix

• Ensure protection restoration runs in a guaranteed cleanup or finalization path.
• Treat restoration as best-effort with retries and clear failure logging.
• If restoration fails, fail the workflow loudly with explicit remediation guidance.

Acceptance criteria

• With unprotect_reviews=true, protections are restored after success.
• With unprotect_reviews=true, protections are also restored after any push failure.
• Restoration is verified by tests that simulate push failure scenarios.