govern(deploy): register deploy-control and GitHub App policy

[zoeyrose]

Summary

Register atrinik/deploy-control in Atrinik's desired-state policy and record its future GitHub App/control-plane integration without provisioning live resources or credentials.

Implementation / behavior

• Add the seed repository's stable policy identity, MIT licensing, public visibility, default branch, repository properties, lifecycle, and no-release policy.
• Require the repository's actual validation and PR-title checks while preserving the existing Actions, Dependabot, community-health, and merge defaults.
• Record a value-free, selected-repository GitHub App contract for successful workflow_run events from atrinik/classic, including exact read-only permissions, secret/variable names, ownership, verification cadence, and revocation guidance.
• Preserve the existing metaserver and Classic package/repository access boundaries and document the Team-plan/manual-provisioning limitation.

Validation

• bin/validate
• bin/publish plan mode for the repository policy delta
• bin/verify-manual-settings with the planned App recorded as pending
• git diff --check

Limitations / follow-up

The GitHub App and installation are intentionally not provisioned by this issue, so their numeric IDs remain null and no credential values, token responses, Cloudflare resource, environment, package grant, or deployment is recorded. Provisioning and the final live identity verification require the control-plane owner after review, following atrinik/deploy-control#3.

Closes #79

[github-actions]

🎉 This PR is included in version 2.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀