repo-config/{develop,main}.json don't declare require_extra_approval_for_unattributed_changes, so configure.sh check always flags it

[ptr727]

Found while resyncing Blog (ptr727/Blog) against the hub, running repo-config/configure.sh check ptr727/Blog release.

The gap

Both live GitHub rulesets on Blog carry an extra pull_request rule parameter the hub's committed payloads don't mention at all:

$ gh api repos/ptr727/Blog/rulesets/<develop-id> --jq '.rules[] | select(.type=="pull_request")'
{"parameters":{...,"require_extra_approval_for_unattributed_changes":true,...},"type":"pull_request"}

$ python3 -c "import json; print(json.load(open('repo-config/develop.json'))['rules'])" | grep pull_request
# no require_extra_approval_for_unattributed_changes key anywhere in develop.json or main.json

Same result on both Blog's develop and main rulesets, both true live, both absent from repo-config/develop.json and repo-config/main.json. Since it's identical across both of one repo's rulesets and the field isn't Blog-specific, this reads as a payload gap (GitHub added this ruleset parameter after the payloads were last written) rather than repo drift, so configure.sh check reports FAIL 'develop'/'main' rule 'pull_request' parameters match the payload on every repo carrying this field, unconditionally.

Ask

Decide the fleet's intended value for require_extra_approval_for_unattributed_changes and add it explicitly to repo-config/develop.json, repo-config/operational/develop.json, and repo-config/main.json's pull_request rule parameters, so check stops flagging every repo and apply doesn't silently reset the field to whatever POSTing a payload without the key resolves to.

I did not run apply on Blog pending this - didn't want to have Blog's live setting reset by an unverified default while the payload's own gap is what's actually stale.

Filed per RESYNC.md section 2's "File defects in the hub" guidance; audit run stamp: audit run 2026-08-22T21:56:31Z | hub d5605f5, ruleset check run 2026-08-22T23:1x UTC (approximate, configure.sh prints no run stamp of its own).