feat: manage yo61/python-template

[robinbowes]

yo61/python-template has just been rewritten from an upstream clone into the house template, and was the last actively developed yo61 repo with no data/ file. This brings it under management.

Modelled on go-udap — the closest analogue (public, Pages via workflow, required status checks). Follows the "state deviations only" convention, so default_branch, delete_branch_on_merge and builtin_ruleset_names are omitted where they already equal the module default.

is_template: true is the first use of that field across all managed repos.

Required status checks

test, commitlint, zizmor.

test is an aggregator job gating lint, the 4-entry pytest matrix and the bootstrap smoke test, so the matrix can grow without editing this ruleset. The docs workflow's build and deploy are deliberately excluded — they only fire on docs/site/** changes, so requiring them would block every non-docs PR.

What the apply will change

Live state was checked before writing this, so the plan should hold no surprises:

Setting	Live now	After apply
is_template	true	unchanged
visibility	public	unchanged
has_issues	true	unchanged
delete_branch_on_merge	true	unchanged
allow_auto_merge	false	true
secret scanning	disabled	enabled
push protection	disabled	enabled
rulesets	0	2 (builtin default_branch + required status checks)

Note on required_signatures

Left false, matching every other managed repo. Worth flagging: python-template's release workflow contains a sync-lockfile job that pushes via the GraphQL createCommitOnBranch mutation specifically so its commit is signed by GitHub's app-flow key — machinery justified in the design spec by a required_signatures ruleset. Since no repo actually enforces signatures, that complexity is currently defensive rather than required. Not changing it here, but it's a discrepancy between the spec's premise and the fleet's real configuration.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RVHmPpVjSiUwR2uWP6LL9y

[yo61-lastlight]

This adds the yo61/python-template repository configuration with the expected public-repo security settings, workflow Pages, default-branch ruleset, and required checks matching the target repo's current CI job names. I did not find any blocking issues in the Terraform/YAML contract.