ci: rename branch-protection caller job id to branch-protection

[rubenvdlinde]

GitHub names a reusable-workflow status context <caller-job-id> / <called-job-name>.

This branch's caller job id was not branch-protection, so the shared branch-protection
workflow reported under the wrong context name, and the org ruleset requirement
branch-protection / check-branch never reported at all — not as a failure, as nothing.

Several of these beta branches carry a second, independent fault: the reusable workflow was
referenced as Conduction/.github instead of ConductionNL/.github. The Conduction org does not
exist (GET /repos/Conduction/.github -> 404), so on those branches the workflow could not even
resolve. Where present, that is fixed here too — renaming the job id alone would not have made the
context appear.

This matters for beta -> main promotion PRs, whose head is beta, so beta's tip is what
decides the context name and the workflow reference.

Does not change what is required and does not touch any ruleset or branch protection.

[rubenvdlinde]

Reviewed as part of today's open-PR sweep. Correct and worth landing — but its base is beta, which is human-gated, so I am not merging it.

One thing worth surfacing: the diff does more than the title says, and the undeclared part is the more important half.

The title is "rename branch-protection caller job id". The diff also changes the org:

-    uses: Conduction/.github/.github/workflows/branch-protection.yml@main
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main

Measured just now:

gh api repos/Conduction/.github    -> 404 Not Found
gh api repos/ConductionNL/.github  -> ConductionNL/.github

origin/beta currently references a repository that does not exist. A caller job whose reusable workflow cannot resolve never starts, so the required context branch-protection / check-branch never reports at all — it sits permanently pending rather than failing. That is the hardest of the dead-gate shapes to notice, because a check that never reports looks exactly like a check that is still running.

So beta has had no working branch-protection gate for as long as that line has been there. The job-id rename in the title is real too (GitHub names a reusable-workflow context <caller-job-id> / <called-job-name>, so protect: produced protect / check-branch and detached the required context), but the org typo is what makes the workflow unrunnable.

Both halves are correct. Flagging the title/diff mismatch only so the org fix is reviewed deliberately rather than merged as a rename.

branch-protection / check-branch reports pass on this PR, so there is no catch-22 blocking it — a human can merge when ready.