Move workflow execution policies from the apply workflow to Crossplane #226

🤖 Generated with Claude Code in an interactive session with the maintainer.

Evidence

• Workflow execution protections became generally available on 2026-09-17. The GitHub Terraform provider's newest release, 6.13.0 (2026-07-08), has no resource for them; checked on the Terraform registry on 2026-09-23. The deployed provider-upjet-github v0.19.1 embeds an even older Terraform provider.
• Until that changes, Apply the checked-in workflow execution policies from a workflow #225 applies workflow-execution-policies/ with a workflow. That works, but it runs a second reconciler beside Crossplane and gives a GitHub Actions workflow an organization-administration token.

What done looks like

• A Terraform provider release adds a resource for organization Actions policies, and a provider-upjet-github release embeds it.
• The policies move into deploy/ as Crossplane managed resources, adopted Observe-first against the live policies the workflow created, so nothing is recreated.
• The apply workflow, its script and its test are deleted. The workflow's organization-administration permission is no longer requested, and this repository's README and AGENTS.md describe the Crossplane path only.

If upstream support drags out

Re-check the Terraform registry and the provider-upjet-github releases monthly, and update the blocker line below. If no Terraform provider release supports these policies by 2026-12-23, request the resource upstream. Filing on a third-party repository needs the maintainer's explicit approval first, and a check that the project accepts AI-assisted contributions.

Blocker: integrations/terraform-provider-github Actions policies resource | upstream | last-verified 2026-10-12: not shipped (the latest release is still 6.13.0 from 2026-07-08, which has none)