Scheduled org-wide puppetsync runs (continuous baseline enforcement)

[silug]

Goal

Run puppetsync on a schedule (e.g. a cron-triggered GHA workflow) against the whole org, so the baseline is continuously enforced instead of enforced in occasional hand-driven sessions.

Prerequisites

This is the capstone on top of:

• Full idempotency: repos that need no changes must pass through cleanly #49 — full idempotency (no-change repos pass through cleanly)
• Renovate-resilient templates: split file management into bootstrap and in-place merge stages #50 — Renovate-resilient templates (scheduled runs must not clobber Renovate's version bumps)
• Build inventory dynamically from the GitHub API instead of hand-maintained repolists #55 — dynamic inventory from the GitHub API (so the schedule doesn't depend on hand-maintained repolists)
• Remove interactive binding.pry fallback from pipeline_stage.rb #52 — no interactive debugger in the critical path (unattended runs must never hang)

Together those make "safe to run when nothing needs changing" true, which is exactly the property a scheduled run needs.

Sketch

• GHA workflow on this repo with a schedule: trigger (plus workflow_dispatch: for manual runs), running the sync plan against the org-wide dynamic inventory.
• Auth via a bot account token; pushes over HTTPS with the token (the push changes using HTTPS basic auth + GitHub token (CI friendly) stretch goal already noted in plans/init.pp).
• The run's three-bucket summary (PR'd / unchanged / failed) becomes the job output; failures should be loud (issue comment, Slack, or failed job).

Effectively this turns puppetsync into the same kind of continuously-running fleet manager that Renovate already is for dependencies, with the two dividing the labor: Renovate owns versions, puppetsync owns structure.