feat(yo61): add helm-charts, drop redundant default keys

[robinbowes]

Add yo61/helm-charts

data/yo61/helm-charts.yaml brings a new public repo under management. It
does not exist on GitHub yet, so the apply creates it empty and ready for the
initial push.

Omitted on purpose:

• create_default_branch — builds a github_branch resource that needs a
  source commit, so it fails against an empty repo. main is established by
  the first push.
• auto_init — left at the default so the repo is created empty.
• additional_rulesets — there are no workflows yet. A required status
  check context declared now would sit Expected forever and block the first
  PR.
• allow_auto_merge and the review count — Tier 2 of
  decisions/2026-08-03-ci-baseline-two-tier-policy.md needs a behavioural
  check, which does not exist yet.

The Tier-1 status-checks gate follows in a separate PR once the repo has CI.
That is also when Pages gets decided: chart-releaser on gh-pages needs
pages.build_type: legacy, whereas publishing OCI artifacts to ghcr.io
needs no Pages config.

Drop redundant delete_branch_on_merge keys

The module defaults delete_branch_on_merge to true
(modules/github-repo/variables.tf:190) and the data files record deviations
only. Eight files restated the default.

commitlint-github-action keeps delete_branch_on_merge: false, which is a
real deviation.

Plan

5 to add, 1 to change, 0 to destroy.

The five creates are all helm-charts: the repository, its collaborators, the
default_branch ruleset, dependabot security updates, and vulnerability
alerts. The repository plans as visibility = "public", has_issues = true,
secret scanning and push protection enabled, auto_init = false, and
delete_branch_on_merge = true from the module default.

None of the eight cleaned repos appear in the plan, which confirms the removal
is a no-op: modules/org passes lookup(..., null) for an absent key, and the
child variable declares nullable = false alongside its default, so Terraform
substitutes true.

The one in-place change is pre-existing drift on python-template — a
create-only template block in state that the config does not declare. It is
unrelated to this PR but will be applied alongside it.

Note

helm-charts's default_branch ruleset gets only the semantic-release-pusher
Integration bypass, not the admin RepositoryRole bypass. modules/org
resolves non-forks from a live org:yo61 fork:false query, which cannot see a
repo that does not exist yet. The next apply adds it. Nothing is blocked
meanwhile: the ruleset carries no review requirement.

Also found, not changed

kuard.yaml:35 and go-udap.yaml:38 set default_branch: main, which is also
the module default. Left alone as outside the scope of this PR. The
visibility: private restatements in ycst-org-uk are deliberate per
quality/criteria.md.

🤖 Generated with Claude Code

[yo61-lastlight]

This PR adds the new yo61/helm-charts repo and removes redundant delete_branch_on_merge defaults from existing repo data. One added field in helm-charts still restates the module's effective public-repo security defaults, so the new file does not satisfy the deviations-only criterion this PR is enforcing.

[yo61-lastlight]

[Important] Drop redundant public-repo security defaults

For visibility: public, modules/github-repo/data.tf already defaults secret_scanning and secret_scanning_push_protection to true when security_and_analysis is omitted, so these lines restate the effective module default and leave this new repo file failing the deviations-only criterion that the PR is applying to delete_branch_on_merge.

[robinbowes]

Fixed in 5f68dfa — the block is removed.

Confirmed the mechanism in modules/github-repo/data.tf:

security_and_analysis_default=var.visibility=="public"? {
advanced_security =null
secret_scanning =true
secret_scanning_push_protection =true
} :nullsecurity_and_analysis=var.security_and_analysis!=null? var.security_and_analysis: local.security_and_analysis_default

advanced_security is optional(bool) and was unset, so the declared block was byte-for-byte the effective default.

Verified against live state rather than by re-reading the config. The repo was applied while this PR was open, so it exists with the block present. After removing it, the plan shows no diff on module.org_yo61.module.repo["helm-charts"].github_repository.this, and the API agrees:

$ gh api repos/yo61/helm-charts --jq '.security_and_analysis'
secret_scanning: enabled
secret_scanning_push_protection: enabled

Two follow-ups from this:

The criterion was pointing at the wrong file. It said cross-check against modules/github-repo/variables.tf, where security_and_analysis defaults to null — the visibility-dependent default is computed in data.tf and is invisible from variables.tf. Widened in the same commit to name both.

Six existing public repos restate the same block: unifictl, kuard, go-udap, homelab-docs, python-template, civi-mcp. Same redundancy, same no-op removal. Left untouched — this PR was scoped to delete_branch_on_merge — and noted under Last triggered so it is not lost.

[yo61-lastlight]

Prior finding fixed: data/yo61/helm-charts.yaml no longer declares the redundant public-repo security_and_analysis block, and the widened criterion now points reviewers at modules/github-repo/data.tf as well as variables.tf. The current diff adds the helm-charts repo with only intentional deviations and removes redundant delete_branch_on_merge: true restatements; I found no remaining blocking issues.