repo-config + source-only publisher: robustness gaps on partial downstream carry

[ptr727]

Context

While carrying the repo-config/ baseline and the source-only publisher into
ptr727/Financial-Modeling (its #14 standup, PR #15), Copilot review surfaced several template-side
robustness gaps that bite any partial downstream carry (a repo that carries only its own
workflow-model variant). Financial-Modeling has adapted locally (owner decision); filing the
template-side fixes here.

1. configure.sh: fail fast on a missing ruleset payload

The apply loop skips a missing file silently ([ -e "$file" ] || continue) and still reports
"Configuration applied". A downstream repo carries only its model's develop variant, so e.g. running
configure.sh <repo> operational in a release-variant repo silently skips the develop ruleset —
a partially-applied configuration that looks successful.

Fix applied downstream (suggest adopting):

for file in "$develop_ruleset" "$script_dir/main.json"; do
    if [ ! -e "$file" ]; then
        echo "Ruleset payload $file not found; aborting to avoid a partially-applied configuration." >&2
        exit 1
    fi
    ...

2. repo-config/README.md breaks on a partial downstream carry

Carried verbatim, it ships:

• dead links to ../AUDIT.md and ../spec/secrets.json (hub-only files, 404 downstream);
• a ruleset-regen snippet hardcoding repos/ptr727/ProjectTemplate (regenerates from the hub's
  rulesets, not the carrying repo's);
• an operational/develop.json reference implying a file the downstream repo doesn't carry;
• a Secrets section describing publish mechanisms (NuGet/PyPI OIDC, Docker tokens) that don't apply
  to a source-only repo.

Suggest: either document the downstream adaptation explicitly (which sections/links a carrying
repo localizes), or restructure the carried README to be downstream-neutral (parameterize the repo
in the regen snippet, drop hub-only cross-links).

Fleet policy note (owner direction): the hub is a private repo and should not be URL-linked
from downstream repos — cross-references should be plain-text mentions. Worth stating in the carry
guidance so downstream docs don't accumulate links that 404 for anyone without hub access.

3. publish-release.yml (dispatch-only instance): vestigial skip logic/wording

In the standalone dispatch-only publisher, the release-create condition
if: exists == 'false' || github.event_name == 'workflow_dispatch' is always true (every trigger is
a dispatch), and the step comment says "Skip create on an existing tag" although the dispatch path
never skips — it refreshes (create-or-update). Both are inherited from the multi-trigger reusable
form where they are meaningful.

Suggest: in the dispatch-only instance, either simplify the condition away or reword the
comment so the behavior reads as create-or-refresh (downstream reviewers flag the mismatch).

References

• ptr727/Financial-Modeling#14 (standup issue) · ptr727/Financial-Modeling#15 (the carry PR whose
  review surfaced these; local adaptations in commits 12be024 / af019fa)
• Related: Template gaps found adapting to a source-only Python repo (Financial-Modeling) #306 / Incorporate #306: adapt template for source-only Python repos #307 (previous downstream-adaptation gaps)

[ptr727]

Downstream resolution update (Financial-Modeling#15): per owner direction the repo now carries local adapted audit tooling — a repo-scoped AUDIT.md (self-audit against the committed repo-config/ baseline) and spec/secrets.json (source-only profile) — so the repo-config/README.md cross-refs resolve locally. Item 2's suggestion stands, refined: the carry guidance should say a downstream repo carries adapted AUDIT.md + spec/secrets.json alongside repo-config/ (self-contained auditability), with hub mentions/links removed.

[ptr727]

Minor addendum: catalog/snippets/configs/vscode-tasks-python.json's header comment says "Every task is type: process", but the aggregator tasks (Python Verify, Lint: All) are dependsOn-only with no type — Copilot flags the imprecision downstream. Suggested wording: "Every command-executing task is type: process…".