v0.2.1

The configuration model was complete in 0.1.0; apply was not. This closes
that gap — everything the YAML can declare, apply now carries out — and
turns the branching scheme this tool prescribes on the tool itself.

0.2.0 was tagged but never published: the release pipeline caught the
--help exit code below and stopped before publishing, which is what it is
there for. Nothing was released under that number, so this is the first
version carrying any of the changes here.

Added

• plan/apply now cover the rest of the configuration model: rulesets
  (created and updated in place, comparing only the rules octoform models, so
  a rule somebody added by hand is never silently stripped), environments,
  ensure_branches, file seeding, default-branch renaming, and the
  automated_security_fixes / private_vulnerability_reporting toggles.
• Renaming a default branch names the workflow files that will break. GitHub
  redirects the branch and retargets open pull requests, but a workflow that
  says branches: [master] keeps parsing and quietly stops matching anything;
  plan reads the workflows first and reports which ones do that.
• default_branch.rename_from gates the rename to names the configuration
  anticipated. A repository whose default branch is not on that list is
  reported, not renamed.
• octoform classify: proposes a type for each unclassified repository from
  classify.rules, prints them, and only records them with --apply.
• octoform properties sync: creates or updates the custom property that
  stores the type and records the declared values. Its allowed values are the
  keys of types, so there is no second list to fall out of step. It writes
  only what differs, which is what makes a second run a no-op.
• A scheduled, audit-only workflow, with examples/self-audit/ as the
  configuration it runs. It never calls apply: a scheduled job that mutates
  repositories turns one bad commit into a fleet-wide change nobody watched.
• The version branch scheme (vMAJOR.x) this project prescribes now applies
  to this project. v0.x is the default branch, and SECURITY.md states the
  whole policy explicitly rather than deferring it to 1.0.
• docs/: a full reference for every configuration key and every command,
  alongside the concepts the rest depends on. In the repository rather than in
  a wiki on purpose — a wiki is a separate git repository that no pull request
  touches, so it starts lying the moment somebody adds an option.

Fixed

• release.yml decided the npm dist-tag after publishing, which cannot work:
  the credential npm exchanges for the OIDC token is scoped to that one
  publish call, so the follow-up npm dist-tag add gets a 401. The tag is now
  computed before publishing and passed to npm publish --tag.
• ci.yml skipped its entire test matrix on a manual tag push. A reusable
  workflow inherits the caller's event, so github.event_name was still
  push and the gate release.yml depends on ran nothing at all.
• octoform --help exited 2. Asking for help is not a usage error, and a
  release job running it as a smoke test — or any script checking the exit
  code — is right to treat a non-zero as failure. Running with no command at
  all still exits 2, because there the usage text really is an error message.
  Never caught before because 0.1.0 was published by hand, so the step that
  runs it had never actually executed.
• The CLI ran a stale build without saying so. bin/octoform.js executes
  dist/, so a failed or forgotten npm run build meant the previous build
  kept running — and its failure mode is quietly doing less than you asked
  for, which reads as the tool ignoring a policy rather than as a stale
  build. It now refuses to start when src/ is newer than dist/, and only
  checks that when src/ is present, since an installed package has none.

Changed

• files[].from resolves against the file that declares it rather than the
  working directory, so an imported preset finds the files sitting next to it.