Epic: relocate the canary-rollout engine + bootstrap into .github (org tooling consolidation)

[don-petry]

Goal

Consolidate the release-promotion / repo-bootstrap tooling into petry-projects/.github so all org tooling + standards live in one canonical home (the #596 principle, extended). Agreed end-state; execution gated on the canary-rollout PR queue draining (see Sequencing).

Why

.github already owns the standards (rulesets in standards/rulesets/, lib/ring-pins.sh, the canonical 346L apply-repo-settings.sh). The orchestrators that apply them still live in .github-private, duplicated/divergent. .github-private is a public repo, so there's no secrecy reason to keep operator tooling there.

Scope — move .github-private → .github

• scripts/bootstrap-new-repo.sh (+ tests/test_bootstrap_new_repo.bats)
• scripts/canary-rollout.sh, scripts/lib/canary-rollout.sh (+ tests/canary_rollout.bats)
• .github/workflows/canary-rollout.yml
• standards/canary-rings.json (ring-membership registry — co-locate with lib/ring-pins.sh already in .github)
• Docs: docs/bootstrap/new-repo-validation.md, docs/release/versioning.md, docs/initiatives/canary-rollout-adr.md

Reconcile / de-dupe (canonical = .github)

• Delete .github-private/scripts/apply-rulesets.sh (the Consolidate the two file-driven apply-rulesets appliers into one (cross-repo bootstrap story) #596 duplicate) — callers use the canonical .github applier.
• Delete .github-private/scripts/apply-repo-settings.sh (129L subset) — canonical is .github's 346L superset. Bootstrap then applies the fuller set (merge-settings + GHAS default-setup) — a latent-gap closure, confirmed acceptable.
• De-dupe scripts/lib/push-protection.sh (divergent shas across repos) — keep .github's.

Workflow-move checklist (canary-rollout.yml)

• Secrets present in .github (GH_PAT_WORKFLOWS, release-manager App creds, etc.).
• Triggers still valid once hosted in .github (schedule/dispatch).
• Cross-repo promotion paths intact — note #1059/#1061 are already fixing cross-repo deployment-record 422s; let those land first so we move the fixed version.
• release-manager App (id 4193127) installed on .github with needed perms (Issues:write gap flagged in #1081/#1085 area).

Sequencing (hard gate)

The subsystem currently has 8 open PRs in .github-private (#1010, #1037, #1046, #1061, #1066, #1078, #1084, #1085) + dependabot #1071, all touching these files, last-committed today. Do NOT start the move until that queue drains — otherwise every in-flight PR conflicts. This epic tracks the move; a companion effort is landing the queue.

Related

• Consolidate the two file-driven apply-rulesets appliers into one (cross-repo bootstrap story) #596 (applier consolidation — PR feat(rulesets): relocate release-channel-tags to .github as targeted org standard (#596) #609 landed release-channel-tags as an org standard)
• Follow-ups Consolidate per-repo replicated rulesets → native org-level rulesets (when on GitHub Team) #611 (Team→native org rulesets), Codify org-level settings as standards/org-settings.json (apply-org-settings.sh) #612 (org-settings.json)

[don-petry]

Queue-drain status (2026-07-04 ~17:50Z)

The .github-private canary-rollout PR queue that gated this migration has drained:

• #1084 MERGED (issue #1081 — sync-issues guard, 4f098af).
• 7 PRs CLOSED as superseded — their fixes had already landed on main via other PRs: #1037→#1044, #1046→851f25d, #1061→d1016c5, #1066→113306d, #1078→#1087, #1085→4f098af.
• Remaining open: #1071 (dependabot actions bump — unrelated to canary tooling).

All 8 were tagged dev-lead:hands-off during the drain.

⚠ One gap to resolve before/with the migration

Issue #1008 (onboard idea→initiative reusables into the registry) is still OPEN and its work is NOT in main — its only PR (#1010) was closed in the supersession sweep without landing (unlike the others, #1008's registry entries initiative-planner/idea-triage/unmanaged were genuinely unlanded). No replacement PR exists. This needs a fresh PR (rebase #1010's canary-rings.json additions onto current main) either before the move or carried into it.

Gate is otherwise open — the subsystem is quiescent enough to execute the relocation.