Add an org-wide repository hygiene sweep that runs on a public runner

[ExtraToast]

What to build

The Repository Hygiene guard fires on every opened/reopened/synchronize in fleet-infra and nix-config — roughly 73 runs a week, each a single job averaging 6.6 seconds and each billing a full minute. That is ~292 minutes/month.

The guard reads pull-request metadata. It needs no private repository content, so it can run in a public repo against the API and cost nothing.

Add an org-wide hygiene sweep to this repo that evaluates open pull requests across the organization on a schedule, and a scheduled caller in the public .github repo.

Understand the trade-off before building this. A sweep is not equivalent to the current gate. Today hygiene is a blocking per-PR check; a cron sweep is advisory — it reports after the fact and cannot stop a merge. If hygiene must stay blocking on any repo, this ticket should relocate only the repos where advisory is acceptable, and say plainly which ones stay on the per-PR gate. Do not silently downgrade a required check into a notification.

Report findings somewhere a human actually reads — a comment on the offending PR, or a single rolled-up issue — not just a workflow summary nobody opens.

Acceptance criteria

• An org-wide hygiene sweep runs from the public .github repo and is billed as free
• It reaches private-repo pull requests via an App token, with unreachable repos warned about rather than skipped silently
• A PR that violates hygiene is surfaced somewhere visible, not only in a run summary
• The decision about which repos keep the blocking per-PR gate is written down, with reasoning
• The sweep is verified to actually fail when given a known-bad PR — confirm the gate can fail before trusting that it passes

Blocked by

• None — can start immediately.

[ExtraToast]

Correction to this issue's premise.

This issue says the sweep drops a per-PR blocking gate and tells the implementer to decide which repos keep it. That decision isn't needed — there is no blocking gate to keep.

Repository Hygiene is not a required status check in any repo in this org. Only Pipeline Complete is, and no repo uses classic branch protection. Read directly from the rulesets:

fleet-infra Main  -> required contexts: Pipeline Complete
nix-config  Main  -> required contexts: Pipeline Complete
GET /repos/{r}/branches/main/protection -> 404 Branch not protected  (both)

So the guard already only reported, and the advisory sweep is a like-for-like replacement rather than a downgrade.

Implemented in #125 and verified against the live org, including proving the gate can fail rather than only that it passed:

Configuration	Result
Default deny-globs	30 repos, 38 open PRs, 0 offenders, exit 0
deny: **/*.yml (negative control)	21 offenders detected, run fails
Same + allowlist: .*	back to 0
exclude-repos	30→28 repos, 21→19 offenders