Org migration: reconfigure CI/CD across all repos

[zeevdr]

Description

Reconfigure GitHub Actions, secrets, permissions, and environments for all repos in the new org.

Org-level setup

• Enable GitHub Actions in org settings
• Create org-level secrets:
  • BUF_TOKEN — for BSR push (decree)
  • PROJECT_TOKEN — PAT for org project board
• Create org-level GitHub Project board (replaces users/zeevdr/projects/2)

Per-repo: decree

• Branch protection on main (require CI check, enforce for admins)
• Enable GitHub Pages (for mkdocs documentation site)
• Verify ghcr.io push works (auto via github.repository_owner)
• Verify goreleaser creates GitHub Releases
• Update project.yml with new org project URL

Per-repo: decree-python

• Branch protection on main
• Create pypi environment (for OIDC trusted publishing)
• Update project.yml with new org project URL

Per-repo: decree-typescript

• Branch protection on main
• Create npm environment (for OIDC trusted publishing)
• Update project.yml with new org project URL

Per-repo: decree-ui

• Branch protection on main
• Update project.yml with new org project URL

Depends on

• Org migration: create fresh repos with clean history #170 (fresh repos created)
• Org migration: update Go module paths (zeevdr → opendecree) #171 (Go paths updated — CI needs to pass)
• Org migration: update Docker images and registry paths #172 (Docker paths updated)

Acceptance criteria

• CI passes on all 4 repos
• Docker images push to ghcr.io/opendecree/
• GitHub Pages deploys docs
• Branch protection active on all repos
• Project board receives issues/PRs from all repos

[zeevdr]

Completed — migrated to opendecree org.