fix: re-import the transferred repos at their new names

[robinbowes]

Recovers from a failure in #66. No infrastructure is at risk — both repos are
live on ycst-org-uk with every secret and environment intact. Only Terraform's
pointer into state was stale.

What went wrong. The moved blocks half worked. They rebound each resource
to the ycst_org_uk provider and the renamed for_each key, exactly as the
migration design's experiment predicted. What they cannot do is rewrite a
resource ID — and for github_repository the ID is the repo name. State held
ycst-admin-docs, so refresh asked GitHub for ycst-org-uk/ycst-admin-docs and
got 404: the rename redirect is keyed on the original owner/name pair
(yo61/ycst-admin-docs), not on the old name under the new owner. Terraform read
that 404 as "resource is gone" and planned to create it.

The design's experiment could not have caught this. Its fixture moved a resource
whose ID was a random string, stable across the move. A transfer-plus-rename
changes the owner and the ID at once; moved handles the first, nothing
handles the second.

The fix. The 8 stale instances were dropped with terraform state rm, which
does not touch GitHub, and imports.tf adopts the same objects at their new
addresses under their new names. removed blocks cannot do the dropping — they
reject instance keys. State was backed up at serial 46 first.

Plan on this branch: 8 to import, 0 to add, 3 to change, 0 to destroy.

The three changes are the two expected collaborator swaps plus
website-testing's auto_init: false -> true. That third one is a state-only
correction: auto_init is create-only and the API never reports it, so import
reads false. It applies in place — Terraform reports update, not replace.

imports.tf is deleted in a follow-up once applied, as the moved blocks would
have been.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C15usdmazQC71xZC1YFGHg

[yo61-lastlight]

Adopts the two repos transferred to ycst-org-uk (#66) at their new owner/name via import blocks after the out-of-band terraform state rm, replacing the now-spent moved blocks. Verified against modules/github-repo/main.tf and modules/org/main.tf: for_each keys (board-docs, website-testing) and resource set (github_repository, github_repository_collaborators, github_repository_vulnerability_alerts["this"], github_repository_dependabot_security_updates["this"]) exactly match what these two repos' data files actually instantiate — no branch/branch_protection/ruleset instances exist for them (create_default_branch and builtin_ruleset_names both unset/empty), so no import is missing. No stale references to the old repo names remain elsewhere in the tree. Clean, well-scoped fix.