Roll out the Zed fleet audit across production organizations #14

Goal

Configure the merged Zed fleet auditor so the weekly run covers the real production organization set rather than only the zed-pkg fallback.

Actions configuration

• Set repository variable ZED_FLEET_ORGS to the reviewed comma-separated production organization list below.
• Set secret ZED_FLEET_GH_TOKEN to a read-only fine-grained token or GitHub App token with metadata/contents access to the selected private repositories.
• Manually dispatch Zed fleet audit once after configuration.
• Attach the resulting zed-fleet-report.json and zed-fleet-report.md to the fleet-remediation project/ticket workflow.
• Keep repository creation and package publication out of the auditor itself; remediation remains reviewable PR/issue work.

Initial production organization list

3FA-app,apostille-me,athlet-o,anticaptrad,benefactor-cc,canonical-cloud,channelsiege,claritas-viz,cliptown,daedalus-fab,embedded-alerts,evento-globolo,fiducia-cloud,file-tunnel,hacker-house-medellin,hypesiege,messaging-intel,networking-components,OmniBlitz,opto-sync,quaestor-ledger,sagitta-stack,scintilla-run,shared-auth,sonus-auris,StreemPilot,usa-acc,voxletra,zed-pkg

Review this list before setting the variable. Add production organizations that expose reusable SDKs and remove archived, fixture-only, application-only, or *-test organizations.

Known blockers already tracked

• 3FA-app/.github#1: missing canonical library/CLI repositories and generated C/C++/Zig clients.
• fiducia-cloud/.github#16: missing canonical library package and remaining repository-family work.

Acceptance criteria

• Scheduled runs use the production list and can read every selected private repository.
• Manual and scheduled runs fail on contract errors while pull-request runs continue to publish debt reports without blocking auditor development.
• Every reported family has a remediation owner and PR/issue trail.
• Test organizations are excluded from production enforcement.