[Phase 0] Layer 0 GitHub-native controls and close the motivating incident #1201

Story

As a repo maintainer/admin,
I want enable the GitHub-native outside-PR controls on ring-0 .github-private and close the motivating spam PR by hand,
so that the volume/native defense layer is in place before the spam-pr-guard reusable (Phases 1–3) ships, and the open incident is cleared.

Independent of the Phase 1–6 code work (which vendors a reusable from petry-projects/.github and consumes it via a caller stub pinned at spam-pr-guard/v1-stable). This phase is admin-UI only; it does not block the code phases from landing on main, only the fleet-enable (ring progression) side of Phase 5.

Acceptance Criteria

1. On ring-0 .github-private, 'Require approval for workflows from all outside contributors' is enabled so fork PRs need maintainer approval to run Actions. (This also protects the spam-pr-guard reusable's dogfood on next, which routes to .github-private per the registry pattern.)
2. A per-repo PR cap for users without write access is configured with a bypass list that includes dependabot[bot] and org-leads; if GitHub does not yet support the needed setting, the decision to defer is recorded on the epic instead.
3. The motivating PR petry-projects/.github-private#1976 is closed by hand with a short explanatory comment.
4. The chosen Layer 0 settings are recorded on the epic (written note or screenshot) so later rings can replicate them when Phase 5 promotes spam-pr-guard/v1-stable → *.

Tasks / Subtasks

• Enable 'require approval for outside-contributor workflows' on .github-private (AC: Addressing PR comments #1)
• Configure the per-repo PR cap and bypass list, or record the deferral (AC: Add multi-agent isolation strategy using git worktrees #2)
• Close petry-projects/.github-private#1976 with an explanatory comment (AC: Add coding standards & principles section to AGENTS.md #3)
• Record the applied Layer 0 settings on the epic for ring replication (AC: Add workflow, environment, and orchestration guidance #4)

Dev Notes

• These are GitHub platform settings, not code — no workflow file changes. A human with repo-admin performs them (hence dev-lead:hands-off).
• actions/checkout v7 already blocks fork PR checkout in pull_request_target by default (enforcement July 20), which validates the metadata-only design that the Phase 3 reusable depends on.
• AGENTS.md notes 'The org automation-PR cap is real and near-silent' — replicate the same bypass posture used elsewhere in the fleet.
• This is discussion Org standard for automatically handling spam / low-effort outside PRs #1198 Layer 0 and enhancement Phase 0; it is independent of the vendored-reusable code stories ([Phase 1] Fix the description-quality check so an unfilled template is not read as complete #1202–[Phase 3] spam-pr-guard workflow in DRY_RUN, with the section 4 row and interaction contract #1204) and can proceed immediately.

Project Structure Notes

No repo files change; the artifact is applied settings plus a recorded note on the epic.

References

• AGENTS.md#the-org-automation-pr-cap-is-real-and-near-silent
• standards/canary-rings.json (shows that next dogfoods on .github-private for every host-in-.github agent, so these Layer 0 controls protect the full dogfood tier)
• Org standard for automatically handling spam / low-effort outside PRs #1198

Story prepared by the BMAD Scrum Master (Bob) for epic #1200. Realigned to the vendored-reusable + caller-stub + canary-rings shape. Status: ready-for-dev.