feat: enforce GitHub fleet repository contract

[rmednitzer]

Scope

Adds a declarative GitHub fleet contract for all 11 repositories plus a read-only validator and scheduled/PR-triggered workflow.

The hard contract validates:

• expected default branch and visibility
• an active named ruleset
• no ruleset bypass actors
• PR-required changes
• force-push and deletion protection
• at least one required status check
• exact aggregate-only context where a repository is already declared enforced

The checker also reports, without failing yet:

• repositories still coupled to individual/matrix job names instead of one stable aggregate gate
• merge commits exposed in repository settings while linear history is enforced
• renovate-config as an archive candidate superseded by infra/renovate-preset.json

Design

The checker is stdlib-only and read-only. GitHub remains the observed control plane; fleet/repositories.json is the desired-state contract. --strict-advisories can promote migration warnings to failures once the corresponding repositories have been reconciled.

Blast radius

No infrastructure resources or repository settings are modified. The new workflow uses contents: read only and performs GET requests against public GitHub repository/ruleset endpoints.

Rollback

Revert this PR; it does not mutate any external GitHub configuration.