feat: add safe-settings per-repo overrides #23

Description

Add per-repo override files for repositories with settings that differ from org-wide defaults.

Acceptance Criteria

• safe-settings/repos/unbound-force.yml created:
  • has_discussions: true (only repo with discussions enabled)
  • 9 custom labels: hero, phase-1, phase-2, spec-005 through spec-009
  • Colors and descriptions preserved from existing unbound-force/.github/settings.yml
• safe-settings/repos/website.yml created:
  • 3 custom labels: blog (e4e669), docs (0075ca), tutorial (7057ff)
  • Descriptions preserved from existing website/.github/settings.yml

Context

These repos have labels and settings beyond org defaults. Other repos (gaze, dewey, replicator, containerfile, homebrew-tap) don't need overrides because the org-level ruleset with {{EXTERNALLY_DEFINED}} status checks handles their CI differences automatically.

References

• Modeled on: complytime/.github/safe-settings/repos/complyctl.yml