feat(bootstrap-repo): recover lost fixes + cli flavor + registry

[jdfalk]

Summary

Three bundled changes after PR #266 merged with only the first of three commits (the two fix commits got dropped — the script on main is currently broken in the same ways the dry-run originally caught).

1. Recover dropped fixes (cherry-picked from feat/bootstrap-repo-skill)

Restores commit ede0515 content that didn't make it through the squash:

• New _sync_one_repo.py shim — calls RepoSetupSyncer.sync_repository(target) directly since ghcommon's CLI only exposes the auto-discover bulk method
• Fix sync-github-labels.py invocation — uses positional (owner, repo) args + --labels-file flag, reads PAT_TOKEN/GITHUB_TOKEN (not GH_TOKEN)
• Fix verify_bootstrap.sh false-positive when required_status_checks is null (no PR-triggering workflows)

Without these, bootstrap_repo.sh fails on every adoption attempt against a non-trivial repo.

2. New cli flavor

Surfaced by attempting to bootstrap magnet-handler — a Go binary distributed via goreleaser. Doesn't fit service (no Dockerfile, ships as native binary) or library (not imported). New cli flavor:

• Seeds CHANGELOG.md only (same as library)
• repository.type: cli in .github/repository-config.yml
• Documented in references/flavors.md with cross-flavor distinctions

3. Adopted-repos registry

Writes ghcommon/.github/bootstrapped-repos.json on every successful bootstrap.

{
  "version": 1,
  "repos": [
    {"owner": "jdfalk", "name": "magnet-handler", "flavor": "cli",
     "mode": "adopt", "first_bootstrapped": "2026-04-25T...Z",
     "last_bootstrapped": "2026-04-25T...Z"}
  ]
}

Idempotent upserts via _update_registry.py — existing (owner, name) entries get last_bootstrapped refreshed; first_bootstrapped is preserved. Skill writes the file but doesn't commit it; manual commit from ghcommon enables future "bootstrap-all" sweeps + cross-machine sharing.

Answers the question "where else are we tracking adopted repos?" — the answer was previously "nowhere centralized."

Test plan

• shellcheck passes
• ruff passes
• quick_validate.py reports skill is valid
• _update_registry.py round-trip test (creates new file, idempotent updates work)
• Run bootstrap_repo.sh --flavor cli --mode adopt --name magnet-handler after merge — first real-world adoption