Promote develop to main: merge-bot every-tier policy + repo-settings/spec/registry updates - #267

- repo-config/README.md: settings.json as a reference-style link (matches the
  doc's convention), and PATCH /repos/{owner}/{repo} not PATCH /repos.
- repo-config/configure.sh: same endpoint precision in the header.
- AUDIT.md: the settings link now points at the file, not the repo-config/ dir.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Codifies the fleet-standard general repository settings as config +
rule, and records two promotion-safety learnings from the develop→main
sweep.

## Settings as config + rule

- **`repo-config/settings.json`** (new) — the fleet-standard general
settings, applied idempotently by **`configure.sh`** (`PATCH /repos`)
alongside the rulesets. The two state-dependent settings are computed by
the script, not stored: `has_discussions` (public repos only) and
`default_branch` (`main`, only when a `main` branch exists — so a repo
still on a rework branch isn't pointed at a missing default).
- Standard: wikis/projects **off**, rebase-merge **off**, merge + squash
**on**, auto-merge **on**, update-branch **on**, **delete-head OFF**,
discussions public-only.
- Documented in **`repo-config/README.md` "Repo Settings"**;
**`AUDIT.md` §6** gains a settings-drift check (renamed to "Validate
Settings, Rulesets, and Secrets").

## Promotion-safety learnings (`AGENTS.md` "Branching Model")

- **Never delete `develop` during a `develop→main` promotion.** The
promotion PR's head *is* `develop`, so `gh pr merge --delete-branch`
(and the repo "auto-delete head branches" toggle — kept **off** for
exactly this reason) deletes `develop`. Includes the
restore-from-head-SHA recovery. *(This bit me during the promotion sweep
— `develop` was deleted on 3 repos and restored to their exact pre-merge
SHAs; hence the codification.)*
- **Spurious whole-file EOL conflicts** (develop declared workflow YAML
LF while main is still CRLF) resolve by taking develop on a throwaway
branch off `main` — develop's `required_linear_history` + PR rulesets
forbid resolving on `develop` directly.

`cspell.json`: add `idempotent`/`idempotently`. All hub linters +
`spec/validate.py` pass.

> Deliberately **not** included: a change to the Copilot re-request
mechanic. I hit a failure this session but traced it to my own wrong
field name (`botReviewerIds` vs the runbook's `botIds`), so the runbook
is likely correct and I left it untouched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

MediaTools finished onboarding to the fleet **csharp+nuget** standard,
so its registry entry — which still described the old non-conformant
`first-branch` state — is now stale. This updates it to reality.

**What changed on MediaTools** (all merged/published):
- Clean `main`+`develop` baseline replaced the `first-branch` history;
standard rulesets applied.
- Fleet-standard workflows + Central Package Management + lint configs.
- **OIDC Trusted Publishing** to NuGet (no `NUGET_API_KEY`); first
stable release [`1.0.4`](https://github.com/ptr727/MediaTools/releases)
live on nuget.org.

**Entry edits:**
| field | before | after |
|---|---|---|
| `groundTruthBranch` | `first-branch` | `main` |
| `hasDevelop` | `false` | `true` |
| `publish` | `[]` | `nuget` / `oidc` |
| `requiredSecrets` | `[]` | `NUGET_USERNAME` |
| `releaseTrigger` | `none` | `two-phase` |
| `driftNotes` | 4 non-conformance notes | 2 minor notes (no in-repo
`repo-config/`; no `WORKFLOW.md` yet) |

`python3 spec/validate.py` passes (22 cataloged, 0 backlog).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

)

`spec/secrets.json` `typeMechanisms` already requires codecov for every
csharp/python repo, but no repo listed `CODECOV_TOKEN` in
`requiredSecrets`, so it was not auditable per repo. Make it explicit
and document the coverage policy.

- **`requiredSecrets += CODECOV_TOKEN`** on all 10 csharp/python repos:
Utilities, LanguageTags, MediaTools, PlexCleaner, PhotoCleaner,
AudioCleaner, NxWitness, aiopurpleair, homeassistant-purpleair,
Financial-Modeling.
- **`secrets.json` codecov note**: it is listed (unlike the implicit
baseline secrets); coverage upload is **report-only by default**
(`fail_ci_if_error: false`); only **aiopurpleair** and
**homeassistant-purpleair** enforce a **99%+** threshold.
- Annotate both purpleair entries with the 99%+ gate.

`python3 spec/validate.py` passes (21 cataloged, 0 backlog).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Two fixes to canonical source files that otherwise propagate to every
repo (caught while propagating them to MediaTools — Copilot flagged
both):

- **WORKFLOW.md line-endings note**: said workflow YAML is "CRLF here",
but the fleet pins `.github/workflows/*.{yml,yaml}` to **LF**
(Actions/Dependabot rewrite it). Now states workflow YAML is LF; other
files follow `.editorconfig`.
- **repo-config/{develop,main}.json**: reformat from jq's default
2-space to **4-space** to match the fleet JSON convention (`[*.json]
indent_size = 4`, as `registry/repos.json` and `.vscode/tasks.json`
use). Updated the README regen command to `jq --indent 4` so
regeneration stays 4-space. Semantically identical (rulesets diff via
normalized jq).

editorconfig-checker + `spec/validate.py` pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

D1.4's parenthetical said "there is no CI workflow-lint; lint workflow
edits locally (actionlint)", but the fleet's `validate-task` runs
**actionlint in its lint job** — so a workflow-only PR *is* validated in
CI, just not smoke-built. Corrected. (Caught by Copilot while
propagating WORKFLOW.md to MediaTools.)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…266)

Closes #224.

## Change

Per maintainer decision, Dependabot should auto-merge **every tier
including semver-major** — the required CI checks are the gate, not the
version magnitude (`Utilities` and `LanguageTags` already run this).

- **`merge-bot-pull-request.yml`**: removed the
`version-update:semver-major` NuGet guard on the `Merge pull request
step`, and the now-unused `Get dependabot metadata step`
(`dependabot/fetch-metadata`) that existed only to feed it. Nothing else
consumed the metadata outputs.
- **WORKFLOW.md D8.1** + **AGENTS.md** merge-bot section: documented the
every-tier policy so derived repos inherit the contract.

## Verification

- `merge-bot-pull-request.yml` parses; no residual
`steps.metadata`/`semver-major`/`fetch-metadata` references remain (the
sole match is the new explanatory comment).
- `spec/validate.py` green (21 cataloged, 0 backlog).

## Downstream tracking (repos still carrying the skip)

- ptr727/PlexCleaner#799
- ptr727/ESPHome-NonRoot#112
- ptr727/VSCode-Server-DotNetCore#69
- ptr727/homeassistant-purpleair — already fixed (reference
implementation)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>