fix(repositories): restore the platform-tenant-template roadmap tracker declaratively

[devantler]

🤖 Generated by the Daily AI Engineer

Problem

platform-tenant-template is a portfolio product whose roadmap must live in GitHub Issues on its
own repository, but the live repository has Issues disabled. Its active declarative
Repository
omits hasIssues, so the provider's optional-boolean zero value is authoritative and the
github-config tenant reverts an out-of-band enablement.

This was reproduced against the live control plane on 2026-08-10:

• the REST setting was changed to has_issues=true and read back at 00:54:29Z;
• the first roadmap anchor was created as
  platform-tenant-template#133
  and added to Project 5 as Backlog; and
• by 00:57:20Z, the reconciler had restored has_issues=false; issue reads returned HTTP 410 and
  the roadmap became inaccessible again.

This is not a UI setting to toggle repeatedly. It is declarative drift in the source of truth and
blocks the product from having the contract-mandated issue roadmap.

Part of #56.

Proposed direction

1. Declare hasIssues: true in
   deploy/repositories/platform-tenant-template.yaml at the live value this product requires.
2. Extend the repository update-policy/drift coverage so removing or falsifying this field fails
   closed; an absent optional boolean must not silently disable the tracker again.
3. Ship the signed GitHub-config artifact and verify has_issues=true persists after the
   reconciliation marker advances.
4. Recover the already-created roadmap anchor fix(deploy): preserve Actions release labels #133: set its canonical Issue Type to Epic and
   verify its Project 5 item remains in Backlog rather than creating a duplicate roadmap.

Acceptance criteria

• kubectl kustomize deploy/ and all seven repository validation commands pass.
• The rendered platform-tenant-template Repository declares hasIssues: true.
• A negative mutation that removes or disables the field is rejected by the focused contract test.
• After merge, release, and reconciliation, two live reads separated by a reconciliation advance
  report has_issues=true.
• platform-tenant-template#133 is readable, labelled roadmap, typed Epic, and present on
  Project 5 with Status Backlog.

Rough size

Small: one declarative setting, focused regression coverage, and downstream reconciliation proof.

[coderabbitai]

🔗 Related PRs

#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#127 - fix(repositories): keep org-enforced signoff out of update payloads [merged]
#129 - refactor(deploy): rename gitops-tenant-template to platform-tenant-template [merged]
#136 - fix(repositories): declare org-enforced signoff so updates can apply [merged]
#140 - ci: check declared repository settings against live GitHub [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!