[vitormattos]

Summary

• Replace the discovery + per-repository matrix with a single organization-scoped governance job.
• Keep the GitHub App private key behind the required ruleset-sync environment approval (one approval per run).
• Plan with administration:read and apply with administration:write only on an explicit workflow_dispatch with apply=true.
• Keep reconciliation dry-run by default, report DRIFT in logs without a false workflow failure, and propagate actual API/configuration errors.
• Split plan/apply concurrency; newer plans cancel obsolete plans without cancelling a manual apply.

Cause

The previous workflow created a protected job for each repository, which resulted in dozens of pending environment approvals. The dry-run also treated expected drift as exit code 1, making every repository job red until an independently authorized apply.

Dependency and rollout

Depends on LibreCodeCoop/github-governance#36. This PR pins the reviewed signed commit from that PR, rather than an unpinned branch. Merge/verify the upstream PR first. After an upstream tagged release, update the SHA plus version comment for automated dependency tracking.

This PR does not run or approve a privileged governance apply. The private key is unchanged and remains environment-scoped; plans still require a single environment approval.

Validation

• Workflow changes limited to the governance caller workflow.
• Verified the new job has no matrix, uses a read-scoped token for plan, and requires manual apply=true before obtaining administration:write.
• New upstream CLI behavior validated by 47 passing Vitest tests, TypeScript typecheck and build.
• Environment protection and ruleset contents remain unchanged.

Security tradeoff

The apply token is installation-scoped across the organization's installed repositories, not repository-scoped like the old matrix token. This is required by the existing organization-level CLI and is gated by ruleset-sync review and explicit manual apply. No broader GitHub App installation permissions were introduced.