chore: disable workflow PR approval across org and repos

[jflowers]

Context

The governance scan (2026-08-21) flagged can_approve_pull_request_reviews: True at both the org level and 8 of 9 repos (only gaze has it blocked).

Action

Org-level (manual):

Disable in: https://github.com/organizations/unbound-force/settings/actions
Under Workflow permissions, uncheck Allow GitHub Actions to create and approve pull requests.

Repo-level:

After the org-level change, repos that haven't overridden the setting will inherit the org default. Verify each repo's setting matches.

gaze already has can_approve_pull_request_reviews: false -- no change needed there.

Acceptance Criteria

• Org-level can_approve_pull_request_reviews is False
• All 9 repos show can_approve_pull_request_reviews: false
• Next governance scan shows 0 repos allowing workflow PR approval