Harden and test ruleset synchronization

[vitormattos]

Summary

Harden the repository ruleset automation and add automated tests and CI checks.

Changes

• pin the nextcloud-bot actor by its stable GitHub user ID
• fail closed when Nextcloud app detection returns errors other than 404
• make bot bypass generation idempotent
• compare effective ruleset state before writing changes
• add --check to report drift without modifying repositories
• add --repo OWNER/REPO to safely target one repository
• add Bats tests for synchronization behavior and ruleset policy invariants
• split validation into dedicated workflows for tests, ShellCheck, actionlint and zizmor
• pin both GitHub Actions and the analysis tool versions used by CI
• keep validation workflows separate from the privileged sync workflow
• discover public repositories with the read-only workflow token
• generate one administration token per repository instead of one token covering the whole organization installation
• serialize privileged ruleset sync runs and add timeouts
• add Dependabot updates with a seven-day cooldown for pinned GitHub Actions
• keep the README focused on the repository purpose and move technical details to docs/

Security

Validation workflows do not receive the ruleset GitHub App credentials and run with read-only repository access.

The privileged workflow no longer creates one administration token with access to every repository in an organization. Repository discovery runs separately with the read-only workflow token, then each matrix job creates a short-lived GitHub App token scoped to exactly one repository with administration: write and runs the sync using --repo.

Unexpected GitHub API errors while detecting appinfo/info.xml now stop synchronization for that repository instead of treating it as a non-Nextcloud repository, preventing transient API or authorization failures from silently removing the nextcloud-bot bypass.

Testing

The Bats suite covers Nextcloud and non-Nextcloud repositories, unexpected API failures, bypass idempotency, repository targeting, API normalization and ruleset policy invariants.

CI checks are isolated by concern:

• Tests
• ShellCheck
• actionlint
• zizmor