repo_policy_sync: distinguish absent GitHub refs from compliant refs

[AlexanderLanin]

Problem

Policies using ensure_exact or ensure_minimal for external GitHub action or reusable-workflow references are currently applicable to every synchronized repository. If a repository has no matching uses: reference, the operation produces no changes and the runner reports compliant.

This makes the report unable to distinguish a repository that uses the target at the required revision from one that does not use the target at all. Policy authors currently need to duplicate the target in a when.file_contains condition to avoid the misleading status.

Desired behavior

Provide operation-aware applicability, or an equivalent policy condition, so that:

• no matching target reference is not-applicable;
• a matching reference at the required revision is compliant;
• a matching outdated reference is changes-required; and
• policy authors do not need to duplicate the target in a regex condition.

The design should preserve a way for a separate policy to require that a reference exists, if that is needed.

First solution idea (initial proposal, not final design)

Let reference operations report whether they are applicable based on whether their target is present:

• ensure_exact and ensure_minimal already know the target repository, workflow path, and reference they inspect.
• If no matching uses: entry exists, the operation could return applicable: false, which the runner maps to not-applicable instead of treating the absence of changes as compliant.
• If a matching entry exists, the existing result mapping remains unchanged: the required reference is compliant, while an outdated reference is changes-required.
• An explicit presence assertion or condition can remain available for policies whose purpose is to require that a reference exists.

The exact API and whether this behavior should be opt-in (for example, through an operation setting) still need discussion. The important part of this first idea is to derive applicability from the reference operation itself, avoiding duplicated target strings in policy conditions and generalizing to other reference-based operations.