feat: foundation scaffolding for org-wide config (Step 0 of 9)

[JacobPEvans-personal]

Summary

Step 0 of a multi-step plan to make terraform-github the single source of truth for all org-level configuration — rulesets, actions settings, per-repo file content, labels. Foundation only: no new resources, no apply needed.

Updated 2026-05-30 to address review feedback (see commit 666f625):

• The previous var.dot_github_repository_id with default 1220572589 and a description mentioning the org login was a magic number wrapped in another magic number. Replaced with data "github_repository" "dot_github" { name = ".github" } in a new data.tf. The org is implied by the provider's owner; the numeric ID is resolved at apply time.
• templates/LICENSE.mit.tmpl removed. Canonical license text belongs to its upstream — Step 7's LICENSE enforcement fetches the MIT body via data "http" against https://api.github.com/licenses/mit at apply time, not from a committed copy.
• Convention prose rewritten to be org-agnostic. The repo's .github is referenced by role ("the org's .github repo"), not by the literal dryvist/.github path. The providers.tf owner is the only place the org login appears.

What lands

• No-magic-numbers convention seeded. No literal repo IDs, no org names in descriptions. The pattern is: data "<resource>" { … } in data.tf for identifiers GitHub already knows; variables.tf for true inputs; config/<name>.yml for thresholds and lists.
• config/rulesets-defaults.yml — push-protection defaults (1 MB max file size, banned extensions .env .pem .key .p12 .pfx). Step 1's native org_push_protection ruleset consumes this via yamldecode(file(...)). The file-size enforcement is native (max_file_size push rule) — no custom workflow.
• main.tf + outputs.tf — resolves the two pre-existing tflint terraform_standard_module_structure warnings. main.tf documents the file-split convention; outputs.tf is intentionally empty per the check's own warning text.
• AGENTS.md + README.md — document the no-magic-numbers / org-agnostic-prose convention; describe data.tf and config/; note that canonical text (LICENSE, COC, etc.) is fetched at apply time. The markdown_lint_enforcement variable keeps its legacy evaluate default — flipping silently changes apply behavior — but new rulesets default to active.

Plan context (revised)

After this PR, the actual terraform apply-bearing steps. Step ordering changed since PR #9 in dryvist/.github was the wrong direction (custom file-size workflow) and got closed.

1. org_push_protection ruleset — native max_file_size + file_extension_restriction push rules. Consumes config/rulesets-defaults.yml. Needs gh-claude-org-admin relaunch for apply.
2. Branch protection + commit format rulesets.
3. Org actions hardening (allowed actions allowlist, default workflow permissions, secret scanning org-wide).
4. Per-repo declarative state via for_each: labels (canonical list from config/labels.yml), MIT LICENSE (body fetched from https://api.github.com/licenses/mit at apply time, no local template), CODEOWNERS.
5. Cleanup of obsolete per-repo file-size cruft (workflow callers, .file-size.yml overrides, the now-redundant _file-size.yml in JacobPEvans-personal/.github).
6. Community health files in dryvist/.github.
7. JacobPEvans-personal/.github CLAUDE.md → AGENTS.md restructure (separate, not in this PR's chain).

Test plan

• tofu init -backend=false && tofu validate — green (with the new data source)
• pre-commit run --all-files (inside direnv exec .) — every hook passes, tflint clean
• Both commits GPG-signed
• Manual review of the rewritten AGENTS.md + README.md convention prose — org-agnostic enough?
• No apply in this PR. The data source data.github_repository.dot_github will be resolved on the next live apply; on its own the PR is observably a no-op against the org.