docs: add repository agent guidance

[zoeyrose]

Summary

• add desired-state, Team-plan, ruleset, required-check, Actions, security, and publisher-safety guidance
• capture current Codecov selected-action, OIDC, and manual GitHub App access contracts
• require the guide to update with major governance rework

Validation

• rebased onto current main
• all policy JSON, Bash syntax, ShellCheck, and git diff checks pass
• bin/publish plan mode completed against live organization state; no apply was performed

Manual verification

./atrinik profile show agent-guidance
settings_path=$(./atrinik path github-settings --profile agent-guidance)
(
  cd "$settings_path"
  find config -name '*.json' -print0 | xargs -0 -n1 jq empty
  shellcheck bin/publish bin/publish-repositories
  bin/publish
)

Review the plan only. Do not add --apply without explicit authority.

[github-actions]

🎉 This PR is included in version 1.1.5 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀