Operationalize scheduled ingestion credentials and main protection

[Svaag]

Summary

The private OKF repository is bootstrapped and the validate workflow is green.
Two operational hardening items still need owner action before scheduled refreshes
are fully production-ready.

Current state

• ✅ AS215932/knowledge exists and is private.
• ✅ Initial OKF bundle, JSONL exports, and SQLite export are committed.
• ✅ validate passes on main.
• ✅ ingest.yml is present for nightly and manual refreshes.
• ⚠️ Cross-repository private reads need an explicit credential.
• ⚠️ main branch protection is blocked by the current GitHub plan/settings.

Required follow-up

1. Configure scheduled-ingestion credentials

Create either:

• a read-only GitHub App, or
• a fine-grained token

with read access to the configured source repositories, including the private
AS215932/hyrule-business repository.

Save the credential as this repository secret:

KNOWLEDGE_GH_TOKEN

Why this is needed: the workflow falls back to GITHUB_TOKEN, but that token
cannot read sibling private repositories such as AS215932/hyrule-business.

Minimum required access:

• Metadata: read
• Contents: read
• Issues: read
• Pull requests: read

2. Enable main branch protection

Protect main once the account/org plan supports branch protection for private
repositories, or move this repository to a plan where private branch protection
is available.

Attempted REST branch-protection setup returned:

HTTP 403: Upgrade to GitHub Pro or make this repository public to enable this feature.

Desired protection rules:

• Require PR before merge.
• Require the validate check to pass.
• Require branches to be up to date before merge.
• Require at least one approving review.
• Dismiss stale reviews.
• Require conversation resolution.
• Disallow force pushes.
• Disallow branch deletion.

Acceptance criteria

• Nightly/manual ingest can clone every configured source repository.
• AS215932/hyrule-business is included in scheduled refreshes.
• Refresh PRs are opened automatically when generated OKF changes.
• PRs require a green validate check before merge.
• Refresh PRs remain review-gated and are never auto-merged.