Promote the cloudflare and data-product-controller repositories to managed settings #308

🤖 Generated by the Agentic Engineer

Evidence

cloudflare and data-product-controller are adopted Observe-only by #306 (the first stage of the Observe-first flow). Against the org-wide merge policy that deploy/repositories/kustomization.yaml declares for every repository, a live read on 2026-09-27 shows:

• cloudflare: merge commits and rebase merging are enabled, "always suggest updating pull request branches" is off, and head branches are not deleted after merge.
• data-product-controller: "always suggest updating pull request branches" is off.

Observe-only means Crossplane writes nothing, so scripts/check-repository-drift.sh reports these settings as DRIFT until the resources are promoted.

Audience and problem

Both are portfolio products. Until promotion they sit under the org's declared merge policy on paper only, and the scheduled drift check stays red for them.

Hypothesis and success signal

Promoting both Repository resources to Observe/Create/Update, the same way the actively managed repositories are declared, lets Crossplane apply the shared merge policy. Success: the drift check reports no DRIFT for either repository after reconciliation.

Acceptance criteria

• Both Repository resources report Synced/Ready on the live cluster before promotion.
• Both move to the actively managed group in deploy/repositories/kustomization.yaml with managementPolicies: ["Observe", "Create", "Update"].
• After reconciliation, the drift check reports no DRIFT for cloudflare or data-product-controller.

Size

S — two policy promotions, gated on the live Synced/Ready read.