feat: initialize managed repositories

## Summary

Enable `auto_init` for every centrally managed repository so a new
repository receives an initial commit and `main` branch at creation
time.

## Impact

- New repositories can immediately receive branch protection and be
bootstrapped through a normal scoped branch and pull request.
- Existing repository content, secrets, SOPS data, workflows, and
branch-protection settings are unchanged.

## Validation

- Reviewed the secret-free diff: one change in `gh-repositories.tf`.
- Verified against the GitHub provider documentation that `auto_init`
creates an initial commit.
- PR CI plan/checks are the validation authority.

Author: xnoto

gh-repositories.tf

@@ -3,7 +3,7 @@ resource "github_repository" "repositories" {
   name                        = each.key
   archived                    = contains(local.archived_github_repositories, each.key)
   visibility                  = var.github_visibility
-  auto_init                   = each.key == "charts"
+  auto_init                   = true
   allow_squash_merge          = true
   allow_merge_commit          = true
   allow_rebase_merge          = false