Epic: relocate the canary-rollout engine + bootstrap into .github (org tooling consolidation)

Goal

Consolidate the release-promotion / repo-bootstrap tooling into petry-projects/.github so all org tooling + standards live in one canonical home (the #596 principle, extended). Agreed end-state; execution gated on the canary-rollout PR queue draining (see Sequencing).

Why

.github already owns the standards (rulesets in standards/rulesets/, lib/ring-pins.sh, the canonical 346L apply-repo-settings.sh). The orchestrators that apply them still live in .github-private, duplicated/divergent. .github-private is a public repo, so there's no secrecy reason to keep operator tooling there.

Scope — move `.github-private` → `.github`

scripts/bootstrap-new-repo.sh (+ tests/test_bootstrap_new_repo.bats)
scripts/canary-rollout.sh, scripts/lib/canary-rollout.sh (+ tests/canary_rollout.bats)
.github/workflows/canary-rollout.yml
standards/canary-rings.json (ring-membership registry — co-locate with lib/ring-pins.sh already in .github)
Docs: docs/bootstrap/new-repo-validation.md, docs/release/versioning.md, docs/initiatives/canary-rollout-adr.md

Reconcile / de-dupe (canonical = `.github`)

Delete .github-private/scripts/apply-rulesets.sh (the Consolidate the two file-driven apply-rulesets appliers into one (cross-repo bootstrap story) #596 duplicate) — callers use the canonical .github applier.
Delete .github-private/scripts/apply-repo-settings.sh (129L subset) — canonical is .github's 346L superset. Bootstrap then applies the fuller set (merge-settings + GHAS default-setup) — a latent-gap closure, confirmed acceptable.
De-dupe scripts/lib/push-protection.sh (divergent shas across repos) — keep .github's.

Workflow-move checklist (`canary-rollout.yml`)

Secrets present in .github (GH_PAT_WORKFLOWS, release-manager App creds, etc.).
Triggers still valid once hosted in .github (schedule/dispatch).
Cross-repo promotion paths intact — note feat: implement issue #640 — [Phase 4] Wire the gate into the PR/agent-dispatch workflows #1059/feat: implement issue #645 — [Phase 3] Integrate the linter into the compliance audit (informational) + org-repo import consistency #1061 are already fixing cross-repo deployment-record 422s; let those land first so we move the fixed version.
release-manager App (id 4193127) installed on .github with needed perms (Issues:write gap flagged in Standard .gitignore baseline should exclude Python bytecode (__pycache__/, *.pyc) #1081/Org Status — 2026-09-07 #1085 area).

Sequencing (hard gate)

The subsystem currently has 8 open PRs in .github-private (#1010, #1037, #1046, #1061, #1066, #1078, #1084, #1085) + dependabot #1071, all touching these files, last-committed today. Do NOT start the move until that queue drains — otherwise every in-flight PR conflicts. This epic tracks the move; a companion effort is landing the queue.

Consolidate the two file-driven apply-rulesets appliers into one (cross-repo bootstrap story) #596 (applier consolidation — PR feat(rulesets): relocate release-channel-tags to .github as targeted org standard (#596) #609 landed release-channel-tags as an org standard)
Follow-ups Consolidate per-repo replicated rulesets → native org-level rulesets (when on GitHub Team) #611 (Team→native org rulesets), Codify org-level settings as standards/org-settings.json (apply-org-settings.sh) #612 (org-settings.json)

Queue-drain status (2026-07-04 ~17:50Z)

The .github-private canary-rollout PR queue that gated this migration has drained:

feat: implement issue #647 — [Phase 4] Promotion mechanism: informational to blocking after two clean audit cycles #1084 MERGED (issue Standard .gitignore baseline should exclude Python bytecode (__pycache__/, *.pyc) #1081 — sync-issues guard, 4f098af).
7 PRs CLOSED as superseded — their fixes had already landed on main via other PRs: Decision: ruleset findings are configuration, not code — route them off dev-lead and give the reconciler a runner #1037→feat: implement issue #1038 — apply-repo-settings.sh aborts before the ruleset self-heal — 30/30 CI runs failed, pr-quality convergence has never executed #1044, canary gate: a v-scoped channel tag shadows the release tag in _gh_candidate_cut_date, so any cross-repo agent adopting v<M>-<tier> channels is permanently BLOCKED (indeterminate) — blocks #1592 #1046→851f25d, feat: implement issue #645 — [Phase 3] Integrate the linter into the compliance audit (informational) + org-repo import consistency #1061→d1016c5, Autocut runs before promote-all in the same job, so a busy agent's dwell resets every tick and can never promote — dev-lead stuck at next since 08-12 (blocks #1592) #1066→113306d, Register agents.solution-architect in canary-rings.json (cross-repo prerequisite for .github-private#1631) #1078→feat: implement issue #1063 — Repin dev-lead caller stub: dev-lead/v1-ring0 -> dev-lead/v139-ring0 (orphaned channel family, 152 commits behind, #1592) #1087, Org Status — 2026-09-07 #1085→4f098af.
Remaining open: 💡 Dependabot Alert Automated Security Triage Pipeline Standard #1071 (dependabot actions bump — unrelated to canary tooling).

All 8 were tagged dev-lead:hands-off during the drain.

⚠ One gap to resolve before/with the migration

Issue #1008 (onboard idea→initiative reusables into the registry) is still OPEN and its work is NOT in main — its only PR (#1010) was closed in the supersession sweep without landing (unlike the others, #1008's registry entries initiative-planner/idea-triage/unmanaged were genuinely unlanded). No replacement PR exists. This needs a fresh PR (rebase #1010's canary-rings.json additions onto current main) either before the move or carried into it.

Gate is otherwise open — the subsystem is quiescent enough to execute the relocation.

fix(#613): address advisory-bot findings (Gemini/Copilot/CodeRabbit)

feat(#613): relocate canary-rollout engine + bootstrap into .github (…

feat(#613): enable canary-rollout schedule in .github (cutover) (#628)

docs(#631): de-duplicate versioning.md (.github-private is authoritat…

fix(canary-rollout): autocut cuts inline via gh-api — no sibling cut-…

feat(#1008): onboard initiative-planner + idea-triage to canary-rollo…

feat(#1008): onboard initiative-planner + idea-triage (organic-traffi…

ci: add canary-rollout-tests.yml — enforce the engine's bats suite (C…

Closing — the relocation is complete and verified:

`scripts/canary-rollout.sh` + `scripts/lib/canary-rollout.sh` + `standards/canary-rings.json` + both bats live in `.github`; `.github-private` no longer hosts them (404 confirmed).
`.github` is the sole live host of `canary-rollout.yml` (scheduled runs green).
Both follow-ups landed: versioning.md dedup (docs(#631): de-duplicate versioning.md (.github-private is authoritative) #632) and push-protection.sh drift-guard (.github-private#1134).

Remaining org-tooling-consolidation ideas continue under their own issues (#611 native org rulesets, #612 org-settings.json). The engine's bats suite is now CI-enforced via #685.

Add the persona @-mention router (#754)