(reconcile): Standardize each repo's GitHub-side configuration from the template #1658

Problem

Standardizing a repo today stops at the rendered files. Labels, rulesets, repo settings, Actions variables, Dependabot alerts, bot collaborators and App installs are tracked only by docs/CHECKLIST.md, which copier re-renders on every update, so its ticks are never state: ponderous-site shows 65 unticked and 0 ticked items although labels, project and CI App were set up in the last rollout. The 2026-10-26 fleet audit found delete_branch_on_merge off on all 14 repos, no main ruleset on 5 repos, 7 rulesets missing the template's closing-keywords and devcontainer-verify contexts, and harmon-infra requiring its own check names. Every standardize mode should end with a reconcile phase that works from a classified item list: each item has a read-only probe, a write action or none, and a class (agent-apply; agent-apply with fleet approval; human-only, verified empirically; unknown). Probes run in lanes; writes run only from the parent, serialized per owner. State lives in a standing per-repo configuration status issue written from probe results and in the fleet report, never in the re-rendered checklist. Human-only gaps go to the (HUMAN): collector through track-work.

Acceptance criteria

• [CI] Every sub-issue of this epic is closed with its disposition recorded on the child.
• [CI] task audit:github and task audit:ruleset report clean for every agent-apply item on every managed repo after the parent's reconcile writes.
• [CI] The classified item list is one machine-readable file read by the template tasks and by the skill.
• [HUMAN] After one fleet run, every managed repo has delete_branch_on_merge on, a main ruleset whose required contexts match the template for its profile, template labels, and Dependabot alerts on; the status issue in each repo shows the probe result per item.
• [HUMAN] Human-only items (secrets, App installs, Codex and CodeRabbit toggles, plan features) appear once per owner in the fleet epic's (HUMAN): collector with the probe that proved them missing.

Verify

Re-run the audit before acting: gh api repos/OWNER/REPO --jq .delete_branch_on_merge and gh api repos/OWNER/REPO/rulesets per repo; raw results from 2026-10-26 are described in harmon-init#1273's respec comment. Re-read the ADR and spec named under Provenance for the current design, and re-establish every path, task name or observation above with git grep in the target checkout (and gh for GitHub state) before acting; a renamed path means the claim needs re-checking, not that the problem is gone.

Out of scope

Writing secrets or credentials (never by an agent), plan upgrades, ruleset import through the UI.

Provenance

Filed from the 2026-10-26 standardize-repo redesign session (harmon-devkit, worktree/clear-river-0602). Design record: harmon-devkit ADR docs/decisions/2026-10-26-fleet-standardization-runs.md and spec specs/standardize-repo-fleet.md.