Add fail-closed GitHub protection policy tooling

[abrichr]

Replaces #136.

What this changes

This PR checks in the policy and tooling for nine public OpenAdapt repositories. The planner reads GitHub state without changing it. The apply path requires a fresh plan, an exact confirmation value, and the same audited main commit in every managed repository before the first write.

The validator now checks the exact App owner, repository scope, permissions, workflow guard, token use, and release effect. It rejects compound expressions, replacement credentials, ignored shell failures, stale main reads, and workflows that can report success without the required tag or GitHub Release.

Private Cloud stays audit-only because the current GitHub plan can't enforce protection on that repository.

Merge behavior

This is policy and tooling only. Merging it doesn't call GitHub's protection APIs. It won't create or change a ruleset, branch protection rule, environment rule, GitHub App, secret, release, or deployment.

safe_to_apply is false. The tool refuses to apply the current plan.

Work before one final apply

The Release, Lifecycle, and Docs App identities still need to exist at the configured slugs. The remaining package release workflows need their target-state migrations. The protected release, lifecycle, and docs environments need their final variables, secrets, and reviewer rules. After that work lands, an operator must create a new 15-minute plan, review every action, and run one confirmed apply.

Checks

• Exact reviewed head: 02ca8cbffee77388ea5957e535c9f3d01b0059f2
• Exact base: b0327de8019db6a925104148a094f6f0756b90d2
• Full suite: 320 passed, plus 3 passing subtests
• Policy validation: 9 managed repositories; private Cloud audit-only
• Ruff, formatter, and diff checks passed
• Independent adversarial review found no remaining fail-open path