feat(hygiene): schedule the advisory org hygiene sweep from a public runner

[ExtraToast]

What

Schedules the advisory org-wide hygiene sweep from this public repo. Companion to JorisJonkers-dev/github-workflows#125.

Why here

Actions minutes are billed to the caller, never to the repo holding the reusable workflow. The blocking guard runs in the repo being checked, so each private repo firing it pays for the run — ~292 min/month across fleet-infra and nix-config for a job averaging 6.6 seconds. Standard runners are free in public repos, and this one is public.

This does not replace the blocking guard

repository-hygiene-guard.yml is untouched and still runs per-PR where it's wired up. The guard blocks a merge; this only reports.

fleet-infra and nix-config are excluded precisely because they still run the blocking guard — otherwise the sweep reports the same thing twice. The comment on that input says to remove a name in the same change that removes its gate. That's #34's job, and it needs the ruleset updated too, or PRs there will wait forever on a context nothing reports.

Cadence

Every 6 hours, not every 15 minutes. Advisory findings gain nothing from a tighter loop, and the sticky PR comment is the real signal.

Merge order

Merge JorisJonkers-dev/github-workflows#125 first — this calls @main.

Refs #34

[ExtraToast]

Correction to this PR's own description.

I claimed the guard blocks merges and that replacing it trades away a blocking gate. That is wrong. Repository Hygiene is not a required status check in any repo in this org — only Pipeline Complete is, and no repo uses classic branch protection. Verified by reading the rulesets directly:

fleet-infra Main  -> required contexts: Pipeline Complete
nix-config  Main  -> required contexts: Pipeline Complete
classic branch protection -> 404 Branch not protected (both)

So the guard already only reports. Moving it to a sweep gives up nothing, and the trade-off flagged on #123 and #34 does not apply. The workflow comment has been corrected in the latest commit.

fleet-infra and nix-config stay excluded only to avoid double-reporting while both paths exist — not because they have a gate worth protecting.