chore(governance): inventory the settings automation credential lifecycle

[zoeyrose]

Outcome

Follow up on #50 by making the manually provisioned settings credential an explicit, value-free governance contract. Atrinik should know where the secret belongs, what it authorizes, who maintains it, when it expires or rotates, and how to prove a replacement works without ever storing the credential value.

Evidence

• fix(planning): restore Atrinik work synchronization #50 occurred because ATRINIK_SETTINGS_TOKEN was absent from both live Actions secret scopes even though several workflows depended on it.
• config/manual-settings.json inventories other UI-managed controls but has no repository-secret or credential-lifecycle record.
• bin/validate enforces an exact manual-settings schema, so the missing contract cannot be added without deliberate validation and tests.
• The README records the secret name and general access, and its planning section adds the classic PAT project scope, but neither defines ownership, expiry, rotation, or rollout verification.
• The credential is consumed by Publish settings, Publish planning, and Synchronize project.

Scope

• Add metadata-only inventory for the consuming repository and stable repository ID, secret name and placement, classic PAT type, required scopes, consuming workflows/purpose, accountable owner or role, rotation owner, expiry or rotate-by date, rotation cadence, and runbook reference.
• Record the current credential's confirmed metadata without recording its value, token identifier, or any recoverable credential material.
• Extend validation and negative tests for exact keys, repository identity, uniqueness of repository/secret pairs, allowed credential type/scopes, valid ownership and dates, and rejection of value-like fields.
• Provide a read-only live check that reports whether each inventoried secret name is present at its declared scope. It must never imply that presence proves the value or permissions are correct.
• Document initial provisioning, scope verification, routine rotation, revocation, emergency recovery, rollback, and post-rotation manual plus scheduled synchronization checks.
• Add the secret-provisioning and successful-dispatch gate to future planning rollout checklists.

Acceptance criteria

• ATRINIK_SETTINGS_TOKEN has a complete value-free lifecycle record tied to atrinik/github-settings by stable identity.
• The record identifies purpose, consumers, required scopes, accountable ownership, expiry/rotate-by policy, cadence, and its runbook.
• Validation rejects duplicates, repository-ID drift, unsupported scopes/types, malformed or stale dates, empty ownership, and any credential-value field.
• A read-only plan distinguishes missing live secret metadata from a present secret without accessing its value.
• The runbook proves provisioning/rotation with a successful manual sync, an idempotent follow-up plan, and a successful scheduled run.
• No token value or other credential material appears in configuration, fixtures, logs, commits, or review text.
• bin/validate, new negative tests, relevant publisher tests, and git diff --check pass.

[github-actions]

🎉 This issue has been resolved in version 1.7.14 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀