Keep the KHoist repository identity consistent in GitOps #597

🤖 Generated by the Agentic Engineer

Blocker: maintainer approval of the staged KHoist repository handoff | authority | last-verified 2026-10-15: The private preview is validated; specific approval is still required for dependent reconciliation pauses and managed-reference changes. The session approval request remains unanswered. | asked session 2026-10-14

The maintainer selected KHoist and requested an in-place repository rename. The organization configuration still declares the former name and metadata, and its reconciliation reverses an imperative rename. The remaining repository, module and chart identity migration needs an authoritative handoff.

Update the existing Repository declaration and its labels, Actions policy and team grants together. Preserve the Kubernetes managed-resource identities and the same existing GitHub repository, issues, pull requests, permissions and history. Exclude repository creation and deletion during the rename.

Validate all rendered dimensions, safe update policy, release/deletion contracts and unchanged label/access policy. Deliver through the normal signed configuration publication and read back the canonical repository identity and reconciliation before advancing the signed identity migration.

Part of devantler-tech/data-product-controller#399. The signed identity migration remains in devantler-tech/data-product-controller#400. The API-only workspace in devantler-tech/data-product-controller#393 now ships independently with existing repository, module, chart and signing identities; this handoff is no longer its prerequisite.