feat: declare an analysis runner group restricted to KSail #519

🤖 Generated by the Agentic Engineer

KSail's isolated analysis runners need an organization runner group before ARC can register them through the existing management App. The staged repository registration path does not match the organization registration path. A repository-only runner group preserves the intended boundary when registration moves to the organization level.

Declare the dedicated ksail-code-quality RunnerGroup in this repository's GitHub configuration. Its repository selection must contain only KSail, and it must never use the default group or permit all repositories. Reuse the current ProviderConfig and credential handoff; this change does not add an App, rotate or copy a key, or expand App permissions.

Acceptance criteria:

• Render exactly one namespaced RunnerGroup named ksail-code-quality, using the current default ProviderConfig.
• Set visibility: selected with exactly KSail repository ID 737584922. Enable public-repository use because KSail is public, without adding another selected repository.
• Exclude managed deletion and reject wider repository selections, a different provider, duplicate groups and omitted configuration in required CI.
• Validate fields against the currently pinned provider-upjet-github v0.20.0 schema.
• Deploy the Platform's narrow resource activation, tenant Role and admission prerequisites before publishing this declaration; no ARC activation or runtime probe belongs to this change.
• After publication, verify provider readiness and the actual group's complete allowed-repository selection. Failed or incomplete metadata reads remain UNKNOWN and prevent activation.

The declaration's current dependency is the Platform resource capability repair associated with devantler-tech/platform#4544. That repair is owned separately; the runner group must reconcile before ARC activation resumes.

Part of #56.