State the check mode's real coverage, which is wider than the payloads

[ptr727]

Fixes the finding on the promotion #542. A promotion's head is develop, which is protected, so the fix lands here and #542 picks it up when this merges.

The finding

The header comment says check mode verifies "exactly what the payloads declare" and that anything absent from settings.json is unaudited, but the script also asserts derived/dynamic settings (has_discussions, default_branch) and security toggles in addition to payload-driven rulesets/static settings.

Correct on the facts. check_settings asserts has_discussions (computed from private) and default_branch (when main exists), and check_security asserts the two Dependabot features. None of those comes from a payload.

Why it happened, which is the part worth recording

This is an over-correction of the defect #540 fixed, not a new one.

The header used to over-promise: "every applied ruleset, setting, and security feature must match", while the code compared a fraction. #540 rewrote it to "exactly what the payloads declare", which fixed the over-claim by introducing an under-claim.

A coverage note that is wrong in either direction misleads the person reading it to decide what still needs checking by hand. Over-claiming tells them to skip something unverified. Under-claiming tells them to re-check something already covered, and erodes trust in the rest of the note. Landing on the true statement took two passes and a reviewer, which is the honest record.

The change

The header now names the three groups check actually asserts, says which one is payload-driven, and states the single genuine gap rather than implying a larger one:

• rulesets and static settings, driven by the committed payloads
• the derived settings apply computes, asserted by name
• the two Dependabot security features, asserted the same way
• unaudited: a static setting absent from settings.json, because only that group is payload-driven

Verification

bash -n clean, prose_lint clean, and a live check against this repo still passes with all three groups asserted.

[Copilot]

Pull request overview

Updates the repo-config/configure.sh header comment so check mode’s documented coverage matches what the script actually validates (payload-driven rulesets/static settings, derived settings, and Dependabot security toggles), and clearly states the single remaining gap.

Changes:

• Reword check mode header to describe the three asserted groups (payload-driven + derived + security toggles).
• Clarify which assertions are payload-driven vs asserted-by-name, and narrow the “unaudited” statement to static settings absent from settings.json.