Refresh repo-config carry to current reference; add self-audit carry

[ptr727]

Implements the fleet hub drift finding (ProjectTemplate #330): earlier downstream carries drifted from the current repo-config and merge-bot reference.

Ruleset payload rename + repo-config refresh

Renames the committed ruleset payloads from ruleset-develop.json / ruleset-main.json to develop.json / main.json, matching the current fleet reference paths that the fleet audit letter-checks, and refreshes README.md, configure.sh, and settings.json to the current reference.

Self-audit carry

Adds the adapted self-audit carry per the repo-config Downstream Carry: AUDIT.md and spec/secrets.json, adapted from the blessed Vantage-Config reference for this repo's release model (nuget-oidc + codecov secret mechanisms).

Merge-bot workflow sync

Syncs .github/workflows/merge-bot-pull-request.yml to the current fleet reference, keeping the merge-codegen job this codegen repo needs. Notable: gh pr merge no longer passes --delete-branch, and the header and job comments are updated.

Scope

Live rulesets, settings, and secrets were verified in sync with the reference payloads today; this change touches committed files only.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.43%. Comparing base (8153b16) to head (a9142c9).

Additional details and impacted files

@@ Coverage Diff @@## develop #278 +/- ##
========================================
Coverage 87.43% 87.43% ========================================
Files 11 11 Lines 1973 1973 Branches 243 243 ========================================
Hits 1725 1725 Misses 166 166 Partials 82 82 

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Updates this repo’s carried repo-config/ baseline and merge-bot workflow to match the current fleet reference layout, and adds a repo-scoped self-audit carry (AUDIT.md + spec/secrets.json) for detecting drift in rulesets/settings/secrets.

Changes:

• Renames/refreshes committed branch-ruleset payloads to repo-config/{develop,main}.json and updates repo-config/ documentation + settings payload.
• Adds repo-scoped self-audit artifacts (AUDIT.md, spec/secrets.json) to validate live configuration against committed baselines.
• Syncs .github/workflows/merge-bot-pull-request.yml with the fleet reference (notably removing --delete-branch and updating comments).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
spec/secrets.json	Adds repo-scoped secrets “names-only” audit specification for baseline + NuGet OIDC + Codecov.
repo-config/settings.json	Refreshes repository settings payload (wiki/projects off, allow_update_branch on, etc.).
repo-config/ruleset-main.json	Removes old ruleset payload filename (superseded by repo-config/main.json).
repo-config/ruleset-develop.json	Removes old ruleset payload filename (superseded by repo-config/develop.json).
repo-config/README.md	Updates repo-config documentation to current fleet reference and downstream-carry guidance.
repo-config/main.json	Adds refreshed main branch ruleset payload in the new canonical path.
repo-config/develop.json	Adds refreshed develop branch ruleset payload in the new canonical path.
repo-config/configure.sh	Replaces the prior apply/check script with a model-aware apply script aligned to the new payload layout.
AUDIT.md	Adds repo-scoped audit instructions/scripts for settings, rulesets, and secret-name checks.
.github/workflows/merge-bot-pull-request.yml	Syncs merge-bot workflow with updated fleet reference behavior and commentary.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.