Run the complete governance audits routinely and report gaps #406

🤖 Generated by the Agentic Engineer

Problem

The complete admin-team and repository-coverage checks are manual experiments. A successful one-off run does not surface a later governance gap or read failure.

Acceptance

• Run the existing full admin-team and repository-coverage checks from reviewed main through a daily schedule and manual controls.
• Start scheduling disabled until actual main enabled/disabled controls pass; activation and opt-in retirement remain tracked in Audit live repository admin-team parity before maintenance retirement #395.
• Preserve read-only App permissions, complete-census checks and UNKNOWN on incomplete evidence.
• Report a gap into one fixed tracking issue; close it only after a complete successful audit. Keep private inventory and credentials out of reports.
• Keep issue writing in a separate job with only issue authority and no audit App key.
• Test admission, audit coordination, reporting and source/credential mutations, then verify actual main runs.

Part of #84. Organization-settings monitoring and its retention decision remain separate in #85 and #404. Settings changes, grants, maintenance archive and deletion remain separate gates. This delivery child covers the default-off routine workflow; schedule activation and observation are #395.