docs(oss-harden): update Code Quality for general availability - #85

What changed

• skills/oss-harden/references/github.md states the availability filter for GitHub Code Quality first: organization-owned repositories on GitHub Team or GitHub Enterprise Cloud, not GitHub Enterprise Server, and never a user-owned repository. The paragraph said only that the product must be turned on per repository or organization, which reads as a switch every reader has.
• The same paragraph prices the product at its general availability rate, 10 US dollars per active committer per month plus metered AI usage and Actions minutes. That cost was deferred during the public preview and started on 2026-07-20.
• The prohibition on adding the code_quality ruleset rule where the product is off becomes a readback: gh api repos/{owner}/{repo}/code-quality/setup answers state of configured or not-configured, or 404 for a repository the plan or the ownership excludes. Add the rule only on configured.
• AGENTS.md records why this repository's 404 cannot resolve. svyatov/oss-kit is user-owned, so the general availability announcement does not change it, and nothing short of moving to an organization on one of those plans warrants restoring the rule.

Why this way

The availability limit is the cheapest check a reader can apply, so it goes before the cost and the JSON. Somebody reading the old paragraph on a personal repository would price the product and write the rule before finding out that neither applies.

No rule in STANDARD.md changes. R-SEC-09 asks for static analysis on pull requests and CodeQL with the code_scanning rule satisfies it. Code Quality is a paid maintainability product most audited repositories cannot buy, so a rule requiring it would fail every solo and Free-plan project by construction.

Verification

gh api repos/svyatov/oss-kit/code-quality/setup answers 404 Code quality is not available for this repository, and gh api repos/svyatov/oss-kit --jq .owner.type answers User, both on 2026-08-11. The code_quality rule is still absent from the rulesets REST schema, which lists code_scanning, copilot_code_review, and license_compliance_scanning. The setup response fields come from the code quality REST reference.

Affects