Consolidate per-repo replicated rulesets → native org-level rulesets (when on GitHub Team) #611

Context

All org compliance rulesets — code-quality, pr-quality, release-channel-tags — are organization-level policy in intent, but GitHub's native org-level rulesets (/orgs/{org}/rulesets) require the Team plan. petry-projects is on Free:

GET /orgs/petry-projects/rulesets → 403 "Upgrade to GitHub Team to enable this feature."

So scripts/apply-rulesets.sh replicates each definition onto its target repos as repo-level rulesets — the per-repo loop is our stand-in for the paywalled feature. This is codified in standards/rulesets/README.md (banner note) as of #609.

The consolidation (when licensing allows)

If/when the org moves to GitHub Team:

• Define each ruleset once at /orgs/{org}/rulesets with repository-targeting conditions:
  • code-quality / pr-quality → target all repos (or by property).
  • release-channel-tags → target the reusable-hosting meta-repos (.github, .github-private) by repository_name.
• Retire the per-repo replication loop in apply-rulesets.sh (keep a thin org-apply path).
• Migrate: create the org rulesets, verify enforcement, then delete the now-redundant repo-level rulesets.

Not blocked-on

This is a cost/licensing decision, not an engineering blocker. The per-repo approach is fully functional today. Filing so the simplification isn't lost.

Refs #596, #609.