refactor: centralize GitHub repository policy catalog

[xnoto]

Summary

• Consolidate the existing repository inventory, visibility, topics, protection profile, required checks, Dependabot ecosystems, and auto-merge setting into repositories.tf.
• Preserve SOPS-backed secret lookups and recipients while moving only their non-secret HCL references to secrets.tf.
• Extract the centrally generated Dependabot notification workflow into a template, retain durable import rationale, and generate an agent/operator entry point in the README.

Fixes # N/A

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — Terraform docs validation passed against the updated template; generated downstream workflow output is unchanged.
• Verified plan: 0 to add, 0 to change, 0 to destroy (No changes. Your infrastructure matches the configuration.).
• Root-cause corrections preserve the established SOPS data lookup and exclude two repositories from Dependabot, matching the previous for_each key set. No encrypted file, secret value, state, import, or recipient changed.
• No local OpenTofu or secret-decryption command was run.

Impact and rollout

None intended outside this root. This is an authored and validated configuration refactor; it does not publish, select, reconcile, or apply infrastructure. After merge, the environment-gated main apply remains a separate confirmation-controlled stage.

Rollback: revert the merge in a new PR before approving any apply.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI agent materially produced this change; review the zero-change plan before merge.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
--
No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and