feat(scripts): add read-only repository settings audit

.github/workflows/repo-settings-audit-test.yml

@@ -0,0 +1,46 @@
+---
+name: Repo Settings Audit Tests
+on:
+  workflow_call: {}
+  push:
+    paths:
+      - "scripts/repo-settings-audit.rb"
+      - "scripts/test-repo-settings-audit.rb"
+      - "lib/repository-classes.yml"
+      - ".github/workflows/repo-settings-audit-test.yml"
+  pull_request:
+    paths:
+      - "scripts/repo-settings-audit.rb"
+      - "scripts/test-repo-settings-audit.rb"
+      - "lib/repository-classes.yml"
+      - ".github/workflows/repo-settings-audit-test.yml"
+  workflow_dispatch: {}
+
+# The suite runs entirely against an injected fixture client (see
+# scripts/test-repo-settings-audit.rb); it makes no live `gh api` calls, so it
+# needs no repository permissions beyond checkout.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  repo-settings-audit-test:
+    name: Repo Settings Audit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: "⤵️ Check out code from GitHub"
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: "⚙️ Report Ruby version"
+        run: ruby --version
+
+      - name: "🧹 Syntax check"
+        run: |
+          ruby -c scripts/repo-settings-audit.rb
+          ruby -c scripts/test-repo-settings-audit.rb
+
+      - name: "🧪 Run repo-settings-audit unit tests"
+        run: ruby scripts/test-repo-settings-audit.rb

lib/repository-classes.yml

@@ -0,0 +1,29 @@
+# Canonical per-repository ADR-0007 release class, used by
+# scripts/repo-settings-audit.rb to select the decisions/0013-repository-settings-baseline.md
+# row for a repository.
+#
+# Repositories not listed here use default_class. That matches the
+# "presumptively class 3" methodology already used for the manual audits
+# recorded on z-shell/.github#478: class 3 (git-consumed source) is the
+# largest and lowest-ceremony group, and every repository named explicitly in
+# decisions/0007-release-publication-flow.md or decisions/0008-branching-model.md
+# is listed below so it is never silently defaulted.
+#
+# Updating this file does not change decisions/0007 or decisions/0008 -- it is
+# a machine-readable mirror of their per-repo tables, kept in sync by hand.
+# Add a repository here when it is added to either ADR's table, and note the
+# addition in the owning ADR change, not only here.
+default_class: 3
+repositories:
+  z-shell/wiki: 1
+  z-shell/src: 1
+  z-shell/zd: 1
+  z-shell/zunit: 2
+  z-shell/zsh-lint: 2
+  z-shell/zpmod: 2
+  z-shell/zsh: 2
+  z-shell/zi: 3
+  z-shell/zsh-eza: 3
+  z-shell/z-a-meta-plugins: 3
+  z-shell/zsh-fancy-completions: 3
+  z-shell/.github: 4