Manage GitHub org settings and org-role assignments via Pulumi (#107)

* Manage GitHub org settings and org-role assignments via Pulumi

Brings two click-ops org-level configs under IaC and tightens defaults:

- OrganizationSettings: default_repository_permission read -> none so
  private repos are not implicitly readable by every member; repo
  creation restricted to admins; billingEmail from Pulumi secret;
  security new-repo defaults pinned so the provider does not reset them.
- Org-role assignments: codify lead/core-maintainers -> all_repo_admin.
  moderators -> all_repo_triage and anthropic -> all_repo_write are
  intentionally omitted (being removed).

* Fix config namespace: use project namespace for githubBillingEmail

The github: namespace is reserved for the @pulumi/github provider's own
config keys, so github:billingEmail was rejected as an unknown provider
option. Use the project default namespace instead. preview.yml uses the
same --config flag pattern as the existing Discord secrets.

src/config/orgRoles.ts

@@ -0,0 +1,23 @@
+// GitHub organization-level role assignments.
+// These grant a base permission across ALL repositories in the org via GitHub's
+// pre-defined organization roles, independent of per-repo collaborators in repoAccess.ts.
+// See https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles
+
+export type OrgRoleName =
+  | 'all_repo_read'
+  | 'all_repo_triage'
+  | 'all_repo_write'
+  | 'all_repo_maintain'
+  | 'all_repo_admin';
+
+export interface OrgRoleAssignment {
+  /** GitHub team slug */
+  team: string;
+  /** Pre-defined GitHub organization role name */
+  role: OrgRoleName;
+}
+
+export const ORG_ROLE_ASSIGNMENTS: OrgRoleAssignment[] = [
+  { team: 'lead-maintainers', role: 'all_repo_admin' },
+  { team: 'core-maintainers', role: 'all_repo_admin' },
+];

src/config/orgSettings.ts

@@ -0,0 +1,33 @@
+// GitHub organization-level settings.
+// Captured explicitly so changes go through review. Values mirror current state
+// except defaultRepositoryPermission, which is set to 'none' so private repos
+// (disclosures, community-moderators, GHSA forks) are not implicitly readable
+// by every org member. Explicit access flows from orgRoles.ts and repoAccess.ts.
+
+// billingEmail is required by the provider but intentionally omitted here so it
+// is not committed to a public repo. It is read from Pulumi config in github.ts:
+//   pulumi config set --secret githubBillingEmail <email>
+export const ORG_SETTINGS = {
+  name: 'Model Context Protocol',
+  description:
+    'An open protocol that enables seamless integration between LLM applications and external data sources and tools.',
+  defaultRepositoryPermission: 'none',
+  hasOrganizationProjects: true,
+  hasRepositoryProjects: true,
+  membersCanCreateRepositories: false,
+  membersCanCreatePublicRepositories: false,
+  membersCanCreatePrivateRepositories: false,
+  membersCanCreatePages: false,
+  membersCanCreatePublicPages: false,
+  membersCanCreatePrivatePages: false,
+  membersCanForkPrivateRepositories: false,
+  webCommitSignoffRequired: false,
+  // Provider defaults the following to `false` if omitted, which would silently
+  // disable org-wide security features that are currently on.
+  advancedSecurityEnabledForNewRepositories: true,
+  dependabotAlertsEnabledForNewRepositories: true,
+  dependabotSecurityUpdatesEnabledForNewRepositories: true,
+  dependencyGraphEnabledForNewRepositories: true,
+  secretScanningEnabledForNewRepositories: true,
+  secretScanningPushProtectionEnabledForNewRepositories: true,
+} as const;