fix: upgrade Safe Settings and prevent unsafe full-sync changes #52

Summary

Safe Settings Sync is now authenticated with a dedicated GitHub App, but the current pinned Safe Settings version (2.1.18) has an upstream concurrency defect that causes cross-repository configuration contamination during full sync.

Dry runs proposed renaming repositories such as gaze, website, and dewey to replicator. The current configuration also proposes unintended label deletions and parses the unquoted ci label color 5319e7 incorrectly.

No non-dry-run synchronization should occur until these issues are resolved and reviewed.

Evidence

• Current workflow pin: 594f3c706de6c4ddafb1a86dfa7468f19337e54f (Safe Settings 2.1.18).
• Upstream rename-race issue: Safe-settings app wants to rename all repositories for no reason github-community-projects/safe-settings#944
• Upstream fix: fix: prevent race conditions by creating new objects for repository configurations github-community-projects/safe-settings#943
• Candidate upgrade: Safe Settings 2.1.19, commit 6a8b6ae084987025f6c5de85e3cc6df140f64502.
• The current custom full-sync runner is Probot 13-specific. Testing the newer upstream code fails because Probot 14 initializes its logger asynchronously.

Required Changes

• Upgrade Safe Settings to a reviewed immutable commit containing the rename-race fix.
• Adapt .github/workflows/safe_settings_sync.yml custom full-sync runner for Probot 14 initialization.
• Preserve and validate the existing check_suite full-sync workaround.
• Quote the ci label color value ('5319e7') so YAML treats it as a string.
• Review declarative label behavior and preserve labels that should not be deleted.
• Ensure the GitHub App installation includes exactly the intended managed repositories.
• Update operational documentation with required Actions credentials:
  • SAFE_SETTINGS_APP_ID repository variable
  • SAFE_SETTINGS_PRIVATE_KEY repository secret

Preserve Existing Labels

Safe Settings labels are additive, not authoritative. Convert all label configuration from the plain labels: array to labels.include and add:

exclude:
  - name: '.*'

so it looks like

labels:
  include:
    - name: bug
      color: d73a4a
      description: Something isn't working
  exclude:
    - name: '.*'

Acceptance Criteria

• A dry run against all managed repositories proposes no repository name changes unless explicitly configured.
• The ci label color is passed as 5319e7, not 53190000000.
• Label deletions are either eliminated or explicitly approved repository by repository.
• The workflow completes successfully with the upgraded Safe Settings/Probot versions.
• The expected check_suite reporting limitation is handled without failing the sync.
• A repeated all-repository dry run is idempotent.
• A reviewed single-repository non-dry run completes successfully before any broader apply.

Validation

make safe-settings-validate
make test-unit

Then run Safe Settings Sync with dry-run=true first for a single repository and then for all managed repositories. Review output before any apply.