fix(org): exclude archived repos from drift detection

[robinbowes]

What changed

modules/org/data.tf narrows the drift-detection query from
org:<org> fork:false to org:<org> fork:false archived:false. Archived repos
now drop out of both check "unmanaged_repos" and the non-fork admin-bypass
set.

Also updates the default_branch_ruleset_non_fork_bypass_actors description
and adds a CLAUDE.md convention, so neither describes the old query.

Why

yo61/python-template carried a permanent one-resource plan diff proposing to
remove a template block (owner = "BrianPugh"). It could never converge:

• template_repository is immutable creation provenance. PATCH /repos/{owner}/{repo}
  accepts 26 body parameters and none of them is template_repository.
• Provider v6.13.0 resourceGithubRepositoryRead (line 890) unconditionally
  sets template from repo.TemplateRepository; resourceGithubRepositoryUpdate
  never references the field, and ends by calling Read.

Applying it was tested: the diff returned on the very next plan.

Clearing the attribution therefore required recreating the repo. The original
was renamed to python-template-archived and archived rather than deleted,
which left a repo with no data file tripping unmanaged_repos on every plan —
the noise this PR removes.

Why not give the archived repo a data file

modules/github-repo manages github_repository_collaborators unconditionally,
and a minimal file (builtin_ruleset_names: []) would plan to delete the two
rulesets the repo still carries. GitHub rejects writes to archived repos, so
those calls fail at apply time. Managing an archived repo is not something the
module supports.

Verification

org:yo61 fork:false -> 28
org:yo61 fork:false archived:false -> 27
org:yo61 fork:false archived:true -> python-template-archived

task plan reports No changes. Your infrastructure matches the configuration.
with no unmanaged_repos warning.

The repo swap itself was applied separately: 3 added, 3 changed, 0 destroyed,
and needed no state surgery — resources keyed on repo name re-bound on refresh,
while the two rulesets and Pages (keyed on numeric ids) planned as ordinary
creates.

Trade-off

Archiving a managed repo out-of-band now drops it from drift detection silently
instead of flagging it. An archived repo is frozen by definition and its config
can no longer be applied, so there is nothing actionable to report. The reverse
direction is unaffected: its data file is still rendered, so state and config
keep agreeing. CLAUDE.md documents the trap — a managed repo that gets
archived will otherwise plan archived: true -> false.

Decision records

• decisions/2026-08-25-exclude-archived-from-drift-detection.md
• decisions/2026-08-25-python-template-recreate-to-drop-template-link.md

🤖 Generated with Claude Code

[yo61-lastlight]

The PR narrows org drift detection to active non-fork repos, updates the bypass description, and records the python-template recreation rationale. I checked the changed Terraform paths and their consumers; the query/result contract remains consistent with the documented trade-off.