Schema Inaccuracy

The Actions policies operations describe only two rule types, restrict_actions_actors and restrict_action_events (REST reference). A policy created in the UI with the Require lockfile protection (docs) comes back from GET /repos/{owner}/{repo}/actions/policies/{policy_id} with a third type, require_lockfile. And both POST /repos/{owner}/{repo}/actions/policies and PUT /repos/{owner}/{repo}/actions/policies/{policy_id} reject it, even when the body is exactly what the GET returned.

Expected

If the API supports "Require lockfile", the description should include require_lockfile and its parameters (none, as far as I can tell), and create and update should accept it. If the API does not support "Require lockfile" for writes, it would be helpful for the docs to call out that "Require lockfile" can only be set in the UI (and to specify that that is only during public preview, if that is true).

Reproduction Steps

1. In Settings → Actions → Policies, create a policy targeting all workflows with Require lockfile checked.
2. Read it back:

$ gh api repos/Adam-S-Daniel/_agent-guidance/actions/policies/8215 -H "X-GitHub-Api-Version: 2026-03-10"
{..., "enforcement":"disabled",
 "conditions":{"workflow_path":{"include":["~ALL"],"exclude":[]}},
 "rules":[{"type":"require_lockfile"}], ...}

3. Write the same fields back:

$ gh api -X PUT repos/Adam-S-Daniel/_agent-guidance/actions/policies/8215 -H "X-GitHub-Api-Version: 2026-03-10" --input - <<'EOF'
{"name":"All Workflows Must Use a Lockfile","enforcement":"disabled",
 "conditions":{"workflow_path":{"include":["~ALL"],"exclude":[]}},
 "rules":[{"type":"require_lockfile"}]}
EOF
{"message":"Invalid request.\n\nInvalid property /rules/0: data matches no possible input. See `documentation_url`.","status":"422"}

Creating a new policy with the same rules (POST /repos/Adam-S-Daniel/verify-actions-lock/actions/policies) returns the same 422, with or without "parameters": {}.