[vitormattos]

Summary

• Add opt-in public organization discovery for read-only governance plans using the workflow GITHUB_TOKEN.
• Keep installation-scoped discovery unchanged for Apply. Explicitly reject public discovery combined with --apply or a repository target.
• Preserve per-repository metadata support, DCO, ruleset resolution and existing CLI defaults.
• Enforce Node 24 native TypeScript-compatible syntax at build time.

Why

The two organization caller workflows currently require environment approval even for dry-run planning. Public repository and ruleset read endpoints can be queried with a read token, so planning need not access the privileged GitHub App private key.

Evidence

• npm run check: TypeScript, 53 Vitest tests, build all passing.
• node --check src/cli.ts: passed.
• Full LibreSign public planning against the real API completed using --public-discovery --allow-drift on 39 active repositories, with zero metadata changes after caller-side cleanup.
• Negative tests ensure Apply cannot select public discovery and API errors still fail.

Rollout

Merge before the caller workflow PRs in LibreCodeCoop/.github and LibreSign/.github. Their Apply remains manually triggered and approved in ruleset-sync; Plan becomes read-only and non-protected. No ruleset mutation is performed by this PR.