[vitormattos]

Goal

Add safe, explicitly authorized onboarding of common organization rulesets without touching product-specific CI, DCO policies or existing protections.

Behavior

• --onboard-only --apply creates only a missing organization default ruleset. Caller configuration defines the policy; no organization, product, or bot IDs are hardcoded in the engine.
• Requires an initialized default branch and a privileged classic branch-protection preflight. Legacy protections are reported for review and never removed.
• Existing common rulesets are never modified. Any divergent or additional rulesets require review before onboarding; existing repository metadata and product CI remain untouched.
• Conditional direct-push bypasses (such as nextcloud-bot when appinfo/info.xml is present) are preserved. Additional active rulesets lacking the same direct-push exemption cause a fail-closed review result.
• Existing rulesets that require signed commits are parsed read-only, preventing the onboarding inventory from failing on MCP repositories with signature rules.
• Action input onboard-only exposes the safe mode to caller workflows. No credentials are stored in this repository.

Regression and validation

• Node 24: npm run check passes, including 79 tests, typecheck and build.
• Live no-write preflight returns UNCHANGED for LibreCodeCoop/extract, LibreSign/libresign, LibreCodeCoop/akaunting-docker, LibreCodeCoop/akaunting-mcp, and LibreCodeCoop/suitecrm-mcp.
• 20 Nextcloud app repositories in both organizations audited: all active applicable rulesets include the nextcloud-bot bypass; no classic protection found.
• Historically reported regressions: Recent changes in branch protection are preventing pushing of translations extract#148, Recent changes in branch protection are preventing pushing of translations profile_fields#148, Recent changes in branch protection are preventing pushing of translations LibreSign/libresign#8399 and #9172.

Security and rollout

Privileged writes require explicit --apply with an administration-authorized token. The caller must use a protected environment and scope credentials to the selected repository when practical. No organization-wide apply is performed by this PR. Commit signatures and DCO verified.