Record the layered workflow execution policy as reviewed desired state #208

🤖 Generated by the Agentic Engineer

Evidence

• The live inventories from Inventory live actors that trigger portfolio workflows #204 and Classify every portfolio workflow by exposure before designing execution policies #206 show 142 default-branch workflows across 23 active repositories. 85 of them accept manual or cross-repository entry, and no repository has any workflow execution policy today.
• The GitHub Terraform provider that our Crossplane GitOps path wraps has no resource for these policies. Its latest release (6.13.0, published 2026-07-08) predates the 2026-09-17 GA. Its registry index lists only the older Actions resources: permissions, workflow permissions and runner groups. So policies cannot be reconciled from deploy/ yet.

Audience and problem

The maintainer, who has to approve the final actor allowlists, and whoever applies the policies later. Today the layered design exists only as prose on #202. There is nothing reviewable to approve, and no fixed shape for a later apply or drift check to read.

Expected behaviour

The layered actor/event policy is recorded in this repository as reviewed desired state, in the exact shape the REST API takes (POST /orgs/{org}/actions/policies). CI validates it, and it stays unapplied until a GitOps path exists or the maintainer approves an interim apply.

Acceptance criteria

• A policy file in REST request shape covers at least: pull_request_target/workflow_run prohibited by default, and manual entry to deployment and publication workflows limited to named actors.
• Every actor is a live-resolved numeric ID with its API type, never a login.
• CI rejects an unknown enforcement mode, rule type, actor type or event, and any policy that allows pull_request_target or workflow_run without a documented exception.
• Every policy is evaluate or disabled. active needs maintainer approval.
• The README states that nothing is applied, and why (no provider resource).

Rough size: S.

Part of #202