Codify org-level settings as standards/org-settings.json (apply-org-settings.sh)

[don-petry]

Context

Sibling of the repo-settings codification in #596/PR B. apply-repo-settings.sh manages repo-level state (merge options, GHAS default-setup, check-suite prefs, push protection) via PATCH /repos/{owner}/{repo}/.... There is currently no org-level settings tooling.

Unlike org-level rulesets (paywalled — see the Team-upgrade issue), org-level settings via PATCH /orgs/{org} and related endpoints are available on the Free plan.

Proposal

A distinct declarative standard + applier for organization-level config (applied once to the org, not per-repo):

• standards/org-settings.json — desired org state: member default repo permission, default workflow permissions, org-wide GHAS / secret-scanning defaults, Actions policy, etc.
• scripts/apply-org-settings.sh — idempotent applier (mirrors apply-rulesets.sh / the proposed apply-repo-settings.sh reading repo-settings.json).

Keep it separate from repo-settings.json: different target cardinality (1 org vs N repos) and API surface (/orgs vs /repos).

Scope note

Greenfield (no existing org-settings tooling to reconcile). Independent of #596's applier consolidation; file so the org-level layer is tracked distinctly.

Refs #596.