[#850 D] Codify SKIP_REPOS opt-in + exempt repo-template from feature-ideation placeholder check

[don-petry]

Part of Epic #850. Depends on: #849 (audit pin-check lands there) · Blocks: #854 (convergence).

Problem

Two edge cases the universal-required standard (#844) exposed:

1. repo-template is the seed for new repos, so its feature-ideation.yml correctly keeps the TODO: placeholder project_context (new repos customize it). But Standard: require feature-ideation / pr-auto-review / initiative-driver in ALL repos #844's new feature-ideation-placeholder-context check flags it → a permanent false-positive warning on repo-template.
2. SKIP_REPOS opt-in (.github, .github-private self-manage) was reconciled ad-hoc for .github-private/pr-auto-review in Reconcile universal-required standard (#844) with SKIP_REPOS self-manage: .github-private missing pr-auto-review #847 via a SKIP_OVERRIDES entry. The pattern for a SKIP_REPO to satisfy a universal-required workflow isn't documented/codified.

Scope

1. Exempt repo-template from the feature-ideation-placeholder-context check in scripts/compliance-audit.sh (a template repo is expected to hold the placeholder). Add a bats case asserting repo-template does NOT get the finding while a normal repo still does.
2. Document + codify the SKIP_REPOS → SKIP_OVERRIDES opt-in as the canonical way a self-managing meta-repo satisfies a universal-required workflow (generalize Reconcile universal-required standard (#844) with SKIP_REPOS self-manage: .github-private missing pr-auto-review #847). Ensure the required-workflow audit and the SKIP_OVERRIDES set agree (no repo is both required-and-exempt with no opt-in).

Acceptance criteria

• Audit run on repo-template produces no feature-ideation-placeholder-context finding; a non-template repo on the placeholder still does (bats-covered).
• standards/ci-standards.md (or the deploy script header) documents the SKIP_REPOS opt-in pattern.
• No repo is simultaneously flagged required-but-missing AND intentionally exempt without a SKIP_OVERRIDES opt-in (audit + deploy config are consistent; bats-covered).
• compliance-audit bats suite green.

[don-petry]

Dev-Lead Implementation Plan

Issue: #856 — [#850 D] Codify SKIP_REPOS opt-in + exempt repo-template from feature-ideation placeholder check

Scope

Exempt repo-template from the feature-ideation-placeholder-context audit finding (its seed placeholder is intentional), and codify the SKIP_REPOS → SKIP_OVERRIDES opt-in as the canonical way a self-managing meta-repo satisfies a universal-required workflow, with a static consistency guard so no SKIP_REPO is left required-but-unreconciled.

Implementation Checklist

• scripts/compliance-audit.sh: add pure feature_ideation_placeholder_exempt + feature_ideation_should_flag_placeholder helpers; wire the exemption into check_required_workflows so repo-template is skipped.
• scripts/deploy-standard-workflows.sh: add SKIP_SELF_MANAGED declaration + is_deployable_workflow, skip_repo_self_manages, and reconcile_skip_repo_required_workflows (pure, takes the required-workflow list as args) so every required+deployable workflow on a SKIP_REPO has a reconciliation path (opt-in or self-managed).
• standards/ci-standards.md: document the SKIP_REPOS opt-in / self-manage reconciliation pattern under "Deploying & syncing stubs".

Tests to Write

• test/scripts/compliance-audit/feature-ideation-placeholder-context.bats: repo-template on the placeholder is NOT flagged; a normal repo on the same placeholder still IS.
• test/scripts/deploy-standard-workflows/skip-repo-required-reconcile.bats: reconcile passes on the shipped config; every required+deployable workflow is reconciled per SKIP_REPO; a synthesized gap (dropping an opt-in/self-manage entry) fails.

Test Command

bats --print-output-on-failure test/scripts/compliance-audit/ test/scripts/deploy-standard-workflows/

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Exempt repo-template from the feature-ideation-placeholder-context check (scripts/compliance-audit.sh)
• Codify the SKIP_REPOS → SKIP_OVERRIDES / SKIP_SELF_MANAGED opt-in + consistency guard (scripts/deploy-standard-workflows.sh)
• Document the pattern in standards/ci-standards.md
• TDD: bats cases written first (red), then implementation (green)
• Full suite + dev-lead-lint.sh + shellcheck green

Test Results

ok 718 guard: still fires on an @donpetry-bot mention
ok 719 guard: still gates comment events on trusted author_association
ok 720 guard: still fires when donpetry-bot is assigned as reviewer
ok 721 install: the tests workflow exists
ok 722 install: every curl download uses bounded retries
ok 723 reusable: 'Check commenter trust level' GH_TOKEN uses the canonical fallback
ok 724 reusable: 'Resolve PR URL' GH_TOKEN uses the canonical fallback
ok 725 reusable: 'Trigger review agent' GH_TOKEN uses the canonical fallback
ok 726 stub: GH_PAT_WORKFLOWS input uses the GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS fallback
ok 727 stub: retains DON_PETRY_BOT_GH_PAT (required by the reusable's ack step)
ok 728 stub: uses an explicit secrets mapping, not bare 'inherit'
ok 729 reusable: declares GH_PAT_WORKFLOWS and DON_PETRY_BOT_GH_PAT as required
...
ok: 729   not ok: 0   (full test/ tree)

• test/scripts/compliance-audit/ — 173/173 pass
• test/scripts/deploy-standard-workflows/ + shared libs — 55/55 pass
• bash .dev-lead/scripts/dev-lead-lint.sh — all checks passed (shellcheck 27 files + profile validation)

Files Changed

• scripts/compliance-audit.sh: added pure feature_ideation_should_flag_placeholder + feature_ideation_placeholder_exempt helpers; check_required_workflows now skips the placeholder finding for repo-template (its seed placeholder is intentional) while every non-template repo on the same placeholder is still flagged.
• scripts/deploy-standard-workflows.sh: added SKIP_SELF_MANAGED map + is_deployable_workflow, skip_repo_self_manages, and the pure reconcile_skip_repo_required_workflows guard — every required-and-deployable workflow on a SKIP_REPO must be reconciled via a SKIP_OVERRIDES opt-in OR a self-manage declaration, else the guard (and its bats suite) fails. Refactored the entrypoint into a source-guarded main/parse_args so the pure functions are unit-testable (mirrors compliance-audit.sh).
• standards/ci-standards.md: new "Self-managing meta-repos: SKIP_REPOS + SKIP_OVERRIDES" subsection documenting the two canonical reconciliation paths and the guard.
• test/scripts/compliance-audit/feature-ideation-placeholder-context.bats: repo-template exemption cases (exempt repo NOT flagged; non-template on same placeholder still flagged).
• test/scripts/deploy-standard-workflows/skip-repo-required-reconcile.bats (new): wires the real audit REQUIRED_WORKFLOWS to the real deploy config and asserts the shipped config reconciles cleanly, that dropping an opt-in or a self-manage entry surfaces a gap, and that manual-only required workflows (ci.yml/sonarcloud.yml) are excluded.

Acceptance Criteria

• Audit on repo-template produces no feature-ideation-placeholder-context finding; a non-template repo on the placeholder still does (bats-covered).
• standards/ci-standards.md documents the SKIP_REPOS opt-in pattern.
• No repo is simultaneously required-but-missing AND intentionally exempt without a SKIP_OVERRIDES opt-in — audit + deploy config are consistent, enforced by reconcile_skip_repo_required_workflows (bats-covered).
• compliance-audit bats suite green.

Notes

The entrypoint refactor (top-level exec → source-guarded main) was required so the deploy script's pure helpers can be sourced by bats without executing the deploy sweep — the audit script already used this pattern. Because the audit and deploy scripts both source lib/ring-pins.sh (readonly vars), the reconcile test reads REQUIRED_WORKFLOWS from the audit in a separate subshell rather than sourcing both at once.