feat(repo-schema): manage allow_forking with ownership-aware default

[NWarila]

Summary

Makes `allow_forking` an opt-in YAML key with an ownership-aware default that handles all three GitHub API behaviors correctly.

Why

GitHub's API rejects any PATCH containing `allow_forks` on personal-account private repositories — regardless of the value being set. terraform-provider-github includes the field in every PATCH payload by default, so deploys that manage personal-account private repos always failed with:

```
422 Allow forks setting can only be changed on org-owned private repositories
```

even though the framework didn't intentionally expose the field in YAML. `lifecycle.ignore_changes = [allow_forking]` only prevents diff detection — it doesn't exclude the field from the PATCH payload.

What changes

File	Change
`terraform/30-locals.tf`	`allow_forking` added to `allowed_repo_keys`. Build expression implements the three-way logic.
`terraform/41-resources-github.tf`	Resource explicitly sets `allow_forking`. Removed from lifecycle `ignore_changes`.
`terraform/tests/validation.tftest.hcl`	Removed `rejects_allow_forking` test (key is now accepted).
`terraform/tests/fixtures/bad-allow-forking/`	Deleted; no longer "bad".
`terraform/tests/COVERAGE.md`	G03 row repurposed.

Default policy

Scenario	Default
YAML sets `allow_forking: true|false`	Honor the value
YAML omits + visibility=private + `var.github_is_organization=false`	`null` (provider omits field; no API rejection)
Every other case (public, internal, or org-owned private)	`false` (secure-by-default; forks disabled unless YAML opts in)

Test plan

• Framework CI green (`terraform fmt -check`, `terraform validate`, `terraform test`)
• After merge: bump pin in `NWarila/github-terraform-runner/.github/workflows/terraform-deploy.yaml` and re-run `Deploy GitHub Terraform`; expect the 3 private repos (Resume, Personal, github-sandbox) to apply cleanly without 422.

Local: `terraform fmt -check -recursive terraform/` → clean. (Full `validate` blocked by local terraform 1.14.3 vs the pinned 1.15.4; CI exercises that.)

[github-actions]

Terraform Framework Test Results

Check	Status
Format	✅
Init	✅
Validate	✅
Test Suite	✅

Runs: 54 total, 54 passed, 0 failed, 0 skipped

Full test output

tests/normalization.tftest.hcl... in progress
  run "pattern_blocks_with_only_pattern_field_plans_clean"... pass
  run "merge_queue_with_partial_fields_plans_clean"... pass
  run "pull_request_with_only_merge_methods_plans_clean"... pass
  run "pages_partial_fields_plans_clean"... pass
  run "repo_with_environments_plans_clean"... pass
  run "archived_repo_plans_clean"... pass
  run "empty_repo_set_plans_clean"... pass
  run "org_mode_explicit_codeowners_plans_clean"... pass
  run "personal_mode_synthesizes_codeowners"... pass
  run "push_ruleset_on_private_when_supported_plans_clean"... pass
  run "license_template_defaults_null_not_MIT"... pass
  run "good_minimal_produces_expected_resource_counts"... pass
  run "good_minimal_carries_expected_defaults"... pass
  run "archived_repo_filters_out_downstream_locals"... pass
  run "empty_repo_set_exercises_every_filter_on_zero_input"... pass
  run "good_minimal_produces_zero_environments_zero_codeowners"... pass
  run "explicit_security_and_analysis_overrides_baseline"... pass
  run "multi_branch_sources_all_from_default_not_serially"... pass
  run "fork_repo_passes_through_source_fields"... pass
tests/normalization.tftest.hcl... tearing down
tests/normalization.tftest.hcl... pass
tests/preconditions.tftest.hcl... in progress
  run "rejects_invalid_visibility_enum"... pass
  run "rejects_public_repo_without_description"... pass
  run "rejects_invalid_ruleset_enforcement"... pass
  run "rejects_org_mode_codeowners_required_but_missing"... pass
  run "rejects_env_wait_timer_out_of_range"... pass
  run "rejects_env_branch_policy_mutually_exclusive"... pass
  run "rejects_actions_allowed_actions_enum"... pass
  run "rejects_actions_selected_without_config"... pass
tests/preconditions.tftest.hcl... tearing down
tests/preconditions.tftest.hcl... pass
tests/security.tftest.hcl... in progress
  run "strict_mode_no_gap_plans_clean"... pass
  run "compatibility_mode_no_gap_plans_clean_with_empty_preview"... pass
  run "strict_mode_reports_gaps_across_multiple_visibilities"... pass
  run "no_baseline_no_yaml_collapses_security_to_null"... pass
  run "baseline_feature_enabled_when_capability_matches"... pass
tests/security.tftest.hcl... tearing down
tests/security.tftest.hcl... pass
tests/validation.tftest.hcl... in progress
  run "good_minimal_plans_clean"... pass
  run "rejects_unknown_top_level_key"... pass
  run "rejects_unknown_nested_key"... pass
  run "rejects_duplicate_repo_keys"... pass
  run "rejects_unsupported_push_ruleset"... pass
  run "rejects_code_scanning_tool_typo"... pass
  run "rejects_multiple_nested_typos_in_one_repo"... pass
  run "rejects_secrets_written_as_map"... pass
  run "rejects_token_mode_missing_token"... pass
  run "rejects_app_mode_missing_app_auth"... pass
  run "rejects_token_mode_with_app_auth_also_set"... pass
  run "rejects_app_mode_with_token_also_set"... pass
  run "valid_app_auth_plans_clean"... pass
  run "strict_mode_fails_on_capability_gap"... pass
  run "compatibility_mode_tolerates_capability_gap"... pass
  run "push_ruleset_public_supports_true_still_fails"... pass
  run "push_ruleset_private_supports_false_fails"... pass
  run "push_ruleset_internal_supports_true_passes"... pass
  run "push_ruleset_internal_supports_false_fails"... pass
  run "rejects_invalid_github_owner_regex"... pass
  run "rejects_invalid_auth_mode_enum"... pass
  run "rejects_invalid_baseline_mode_enum"... pass
tests/validation.tftest.hcl... tearing down
tests/validation.tftest.hcl... pass

Success! 54 passed, 0 failed.

Commit: 1e2594a