chore: retire the ycst import blocks and record the migration

[robinbowes]

Closes out the ycst-org-uk migration. No plan-affecting change — task plan
reports No changes. with imports.tf deleted, which is the point of the PR.

Deletes the spent imports.tf, records the migration in decisions/, and
amends two quality/criteria.md criteria that this work proved incomplete.

The moved/removed criterion said instance address changes produce
destroy+create because Stategraph ignores those blocks. That described the
retired stategraph tf wrapper. Under the native CLI moved is honoured,
including across provider aliases and renamed for_each keys — but it cannot
carry a rename, because github_repository's ID is the repo name. Terraform
rewrites the address and the provider binding, never the ID, so refresh looks
for the old name under the new owner and 404s.

The create-vs-exists criterion said a plan proposing to create resources
that already exist means a misconfigured backend. That is one of two causes; the
other is a resource ID that no longer resolves, and the two are indistinguishable
in the plan. The backend was fine here.

Last triggered also records the second firing of the credential criterion — a
${VAR:+set} guard undone by a ${VAR:-...} fallback on the same line printed a
PAT in full. Token rotated. A third firing promotes it to an automated check, so
there is a suggested hook pattern in the file.

Also notes on decisions/2026-08-04-ycst-admin-docs-private-cpanel.md that the
repo now lives at ycst-org-uk/board-docs, and marks the design doc implemented
with a pointer to what its finding 1 got wrong.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C15usdmazQC71xZC1YFGHg

[yo61-lastlight]

Retires the spent imports.tf now that the ycst-org-uk migration is applied, and records the migration + two criteria corrections in decisions/ and quality/criteria.md. Purely documentation and cleanup — no module or data changes, and the PR body's claim that task plan reports "No changes." is consistent with the diff. Cross-checked the new decision record and criteria amendments against decisions/2026-08-13-team-member-roles.md, the referenced design/plan docs, and the existing data/ycst-org-uk/*.yaml files; all references resolve and the technical claims (moved cannot carry a rename because github_repository's ID is the repo name, removed rejects instance keys) are accurate and consistent with the deleted imports.tf's own commentary. No Critical or Important findings.