chore(governance): stop declaring repository identity in settings.yml (#73)

`probot/settings` applies this file on **every push to the default
branch**, so the four identity
keys it declared are instructions, not documentation. The estate has
already paid for exactly this:
`.github/settings.yml` once read `name: "{{REPO}}"`, GitHub collapsed
the illegal braces to dashes,
the repository renamed itself to `-REPO-` on every push, its old URL
404'd, and it was read as a
deleted repository.

This repo still declared `name`, `description`, `homepage` and
`private`.

The repair is convergence on the source of truth, not new content:

- the header becomes the template's own header, which documents the
incident and the rule
  ("THIS FILE MUST NEVER DECLARE REPOSITORY IDENTITY");
- the four identity keys are removed; **everything else is unchanged** —
same repository settings,
  same 18 labels;
- repository identity and visibility stay set out of band, once, by the
owner.

Verified with the estate's own gate, `scripts/check-no-placeholders.sh`,
whose settings.yml guard
runs in template repos too (that exemption is how the original incident
went unseen). On this
branch the guard reports clean.

Author: hyperpolymath

.github/settings.yml

@@ -7,15 +7,45 @@
 # applied by the probot/settings app when changes are pushed to the default
 # branch. Install the app at: https://github.com/apps/settings
 #
-# Template file — replace nesy-solver and Live proof playground for neurosymbolic theorem provers with actual values.
+# ─── THIS FILE MUST NEVER DECLARE REPOSITORY IDENTITY ─────────────────────────
+#
+# It carries NO `name`, `description`, `homepage` or `private` key, and it must
+# never gain one. The reason is a real incident, not a hypothetical:
+#
+#   This file previously read `name: "{{REPO}}"`. probot/settings applies it on
+#   every push to the default branch, so it submitted the literal string
+#   `{{REPO}}` as the repository name. GitHub sanitises an invalid name by
+#   collapsing each run of illegal characters to a dash — `{{REPO}}` became
+#   `-REPO-`. The template renamed itself on every push, its old URL 404'd, and
+#   it was mistaken for a deleted repository. `description` was likewise left
+#   reading the literal `{{DESCRIPTION}}` on the live repo.
+#
+# Two properties make identity keys unsafe here specifically:
+#
+#   1. This is a TEMPLATE. `just repo-init` fills placeholders in repos minted by the
+#      scaffolder — but GitHub's "Use this template" button copies the default
+#      branch verbatim and never runs `just repo-init`. Any placeholder left in a
+#      probot-managed file therefore reaches children unrendered.
+#   2. Identity is not shareable. The template must be public while children
+#      default private; a child cannot inherit either `name` or `private` from
+#      its parent without being wrong.
+#
+# Repository identity and visibility are therefore set OUT OF BAND: once per
+# repo, at creation time, by the operator (the Configure stage of ADR-0003).
+# `just repo-init` deliberately runs NO `gh` commands — it prints the exact
+# `gh repo edit` commands as next steps instead. Fail-closed default: repos
+# stay private unless the owner flips visibility deliberately; the template's
+# own name and visibility are set deliberately by the owner.
+#
+# Everything below is safe to inherit: it is true of every RSR repo regardless
+# of that repo's name, purpose or visibility.
+#
+# Enforced by `scripts/check-no-placeholders.sh`, which fails if this file
+# contains a `{{` token or declares any of the four identity keys.
 
 # ─── Repository Settings ───────────────────────────────────────────────────────
 
 repository:
-  name: "nesy-solver"
-  description: "Live proof playground for neurosymbolic theorem provers"
-  homepage: "https://github.com/hyperpolymath/nesy-solver"
-  private: false
   has_issues: true
   has_projects: true
   has_wiki: false
@@ -105,3 +135,26 @@ labels:
 
 # ─── Branch Protection ─────────────────────────────────────────────────────────
 
+# A required context must name a check that is actually EMITTED, or the branch
+# deadlocks: the check never reports, so it stays permanently pending, and with
+# enforce_admins even the owner cannot merge or push. This block previously
+# required three contexts, two of which no repo has ever emitted —
+#
+#   "codeql"       is emitted as `analyze (actions, none)`  (job id + matrix)
+#   "hypatia-scan" is emitted as `scan / Hypatia Neurosymbolic Analysis`
+#                  (a reusable-workflow call always reports `caller / called`)
+#
+# — while "openssf-compliance" resolved only because its job *id* is literally
+# `openssf-compliance` and it declares no `name:` and no matrix. That is the
+# rule: pin the job **id** to the context string. Note this file is applied by
+# probot on every push to the default branch, so a wrong context here does not
+# merely describe protection, it re-imposes the deadlock on every push.
+#
+# `contexts` is deliberately EMPTY rather than aspirational. Requiring a check
+# that cannot pass is the same defect as requiring one that cannot report, and
+# on this repo no check can currently run at all: GitHub Actions is billing-
+# blocked for PRIVATE repositories on this account ("The job was not started
+# because recent account payments have failed or your spending limit needs to be
+# increased"), which is why every workflow here fails with zero steps while the
+# estate's public repos run normally. Repopulate this list — one context at a
+# time, each pinned to a job id, each verified green — once Actions can run.