Turn on SHA pinning by publishing deploy/repository-permissions/ #253

🤖 Generated with Claude Code in an interactive session with the maintainer.

Evidence

• Production runs provider-upjet-github v0.20.0. The RepositoryPermissions resource definition is Active and its CRD carries shaPinningRequired (checked 2026-09-25).
• The organization-wide audit on Adopt the GitHub surface unblocked by provider-upjet-github TF 6.13.0 (rulesets, Actions SHA-pinning, collaborators) #121 found every uses: on every active repository's default branch SHA-pinned or local, after two fixes that have since merged.
• GitHub accepts $/ self-repository references under enforcement, verified live on platform (Adopt the GitHub surface unblocked by provider-upjet-github TF 6.13.0 (rulesets, Actions SHA-pinning, collaborators) #121, 2026-09-25).
• Yet deploy/repository-permissions/ is still left out of the published manifests, so only platform enforces SHA pinning today, set by hand and not declared.

Problem

Every other repository can run a tag-pinned third-party action. A moved tag then runs different code than was reviewed. #67 declared the policy but it never reconciled, and four managed repositories (aws, kyverno-policies, monorepo, provider-upjet-unifi) are missing from the list.

Change

Publish the directory, add the four missing repositories, and make the coverage guard treat these permissions as a dimension so a new repository cannot be missed again.

Success signal

After release, live sha_pinning_required reads true on every declared repository, and each resource reports Synced and Ready.

Acceptance criteria

• deploy/repository-permissions/ renders into the published manifests.
• Every managed repository has a RepositoryPermissions with shaPinningRequired: true and no Delete policy.
• The coverage guard fails when a managed repository has no RepositoryPermissions.
• After release, the live setting is true on every declared repository.

Rough size: S.