govern(web): register shared web-platform repository and package policy

[zoeyrose]

Summary

Record and converge the organization governance needed for the new shared web-platform repository and package without moving application ownership into it. This is the github-settings companion work for atrinik/atrinik#510.

Scope

• Add the new atrinik/web-platform repository to the desired-state repository inventory with its stable identity, public visibility, MIT license, default branch, ownership, and release policy.
• Review Team-compatible rulesets, merge methods, required aggregate checks, Actions allowlists, Dependabot coverage, and community-health requirements for the producer repository.
• Record the public npm package identity @atrinik/web-platform, source association, package visibility, consumer workflow permissions, and least-privilege package access where the organization policy requires it.
• Keep credentials, tokens, package secrets, and provider values out of configuration and documentation.
• Use the documented publisher plan and live readback before any governance apply; distinguish desired-state records from manual repository/package provisioning.
• Coordinate the repository/package governance with the wrapper contract and producer issue, and preserve the existing website and Observatory consumer contracts.

Acceptance criteria

• Desired-state configuration validates and names the stable repository/package identities without widening access to unrelated repositories.
• Rulesets, required checks, Actions permissions, release policy, package permissions, and community-health expectations are coherent with the producer repository's actual workflows.
• bin/validate, governance script syntax/ShellCheck, publisher plan mode, applicable policy tests, and git diff --check pass from a dedicated delivery worktree.
• Any Team-plan or manual UI limitation is recorded explicitly; no live organization apply is implied by this issue alone.
• The final governance record links atrinik/web-platform#1, atrinik/atrinik#511, atrinik/website#48, and atrinik/observatory#19.

Dependencies

• Parent coordination issue: atrinik/atrinik#510.
• Producer issue: atrinik/web-platform#1.
• Wrapper contract issue: atrinik/atrinik#511.

Non-goals

• Do not implement the shared package or modify consumer application source.
• Do not publish a package, change production deployments, provision Cloudflare resources, or store secret values.
• Do not broaden organization access or replace the documented publisher/apply authorization gate.