[FEAT repo-guard] - New CRD: GithubOrganizationPolicy for cross-org policy consistency

[onuryilmaz]

User Story

As a platform operator, I want to define policies that must hold across all managed GitHub orgs, so that drift between orgs is surfaced automatically rather than discovered manually.

Description

Each GithubOrganization CR is independent and drift between orgs is invisible. A cluster-scoped GithubOrganizationPolicy CRD would define rules that must hold across all managed orgs — e.g. "every org must have branch protection on main", "no org may have public forks enabled" — with the controller surfacing violations as status conditions. This is the enterprise governance layer above per-org management, complementary to the per-org GithubOrganizationRuleset CRD (#112).

Acceptance Criteria

• GithubOrganizationPolicy cluster-scoped CRD defined with schema
• Controller evaluates policies across all managed GithubOrganization CRs
• Violations surfaced as status conditions on the policy resource
• At least two built-in rules implemented: branch protection on default branch, public fork restriction

Reference Issues

Related: #112 (GithubOrganizationRuleset — per-org ruleset management)

[github-actions]

Thanks for opening this issue! 🎉

A maintainer will triage it within 5 business days. You can learn more about our issue workflow in the Issue Lifecycle documentation.

In the meantime, please make sure you have provided:

• A clear problem statement
• Steps to reproduce (for bugs)
• Expected vs actual behavior

This helps us route your issue faster.