chore: govern replacement repositories

[zoeyrose]

Summary

• add every replacement and renamed legacy repository to the pull-request and immutable-release-tag rulesets
• move established required-check contracts to the renamed legacy repositories while intentionally leaving replacement repositories without required checks until bootstrap workflows publish stable aggregate names
• update the manual Codecov GitHub App access inventory and remove archive entries for repositories that do not exist

Validation

• jq -e . config/*.json
• bash -n bin/publish bin/publish-repositories
• shellcheck bin/publish bin/publish-repositories
• git diff --check
• bin/publish (Team-plan organization-scope plan; reviewed, no live apply)

Publisher plan

The plan updates organization defaults for all 20 active repositories, updates the shared pull-request and release-tag rulesets, creates required-CI rulesets for the five renamed legacy repositories, deletes only their five superseded pre-rename CI rulesets, refreshes the organization security baseline for all active repositories, and leaves the already archived nawerhals unchanged. The manual Codecov access list must be confirmed in the organization UI after merge.

Rollback

Revert this pull request and rerun bin/publish to review the inverse plan before any apply.

[github-actions]

🎉 This PR is included in version 1.1.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀