Manage GitHub org settings and org-role assignments via Pulumi (#107)

* Manage GitHub org settings and org-role assignments via Pulumi

Brings two click-ops org-level configs under IaC and tightens defaults:

- OrganizationSettings: default_repository_permission read -> none so
  private repos are not implicitly readable by every member; repo
  creation restricted to admins; billingEmail from Pulumi secret;
  security new-repo defaults pinned so the provider does not reset them.
- Org-role assignments: codify lead/core-maintainers -> all_repo_admin.
  moderators -> all_repo_triage and anthropic -> all_repo_write are
  intentionally omitted (being removed).

* Fix config namespace: use project namespace for githubBillingEmail

The github: namespace is reserved for the @pulumi/github provider's own
config keys, so github:billingEmail was rejected as an unknown provider
option. Use the project default namespace instead. preview.yml uses the
same --config flag pattern as the existing Discord secrets.

.github/workflows/preview.yml

@@ -63,6 +63,7 @@ jobs:
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
           GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
+          ORG_BILLING_EMAIL: ${{ secrets.ORG_BILLING_EMAIL }}
           DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
           DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
         run: |
@@ -77,6 +78,9 @@ jobs:
           if [ -n "$DISCORD_BOT_TOKEN" ]; then
             CONFIG_FLAGS="$CONFIG_FLAGS --config discord:botToken=$DISCORD_BOT_TOKEN"
           fi
+          if [ -n "$ORG_BILLING_EMAIL" ]; then
+            CONFIG_FLAGS="$CONFIG_FLAGS --config githubBillingEmail=$ORG_BILLING_EMAIL"
+          fi
 
           # Run preview and capture output
           set +e