[vitormattos]

Summary

• Remove only the previous per-repository metadata declarations from this organization's governance.config.json (metadata support in the shared engine remains unchanged; GitHub repository metadata is not deleted).
• Run Plan automatically with a repository read-only GITHUB_TOKEN, without entering the protected ruleset-sync environment.
• Require manual workflow_dispatch with apply=true, a successfully completed Plan, GitHub App administration:write, and ruleset-sync approval before applying.
• Allow an optional repository name in manual dispatch, to apply to a single repository first. A blank name targets the whole organization's active public repositories.
• Keep the existing OrganizationAdmin and Maintainers ruleset bypass policies unchanged.

Dependency

Depends on LibreCodeCoop/github-governance#37, pinned to the verified signed commit 3a02c8635a589f7213abd422a4d8b250a92e7ced.

Validation

• Shared engine: 53 tests, TypeScript typecheck and build passed; Node-native TypeScript syntax validated.
• Read-only plan from local terminal against real GitHub API returned all active public repositories (LibreSign 39; LibreCodeCoop 126), with no metadata operations.
• Caller YAML parsed successfully; Plan has no environment access and can only read; Apply has a protected environment and requests write permission.
• Two signed, DCO-compliant commits keep metadata cleanup separate from workflow changes.

Safety and rollout

Merge the shared engine PR #37 before this caller PR. The two organization workflows are intentionally not applying rules automatically. After reviewing the latest Plan results, manually apply a single representative public repository, confirm the active rulesets, then perform full organization Apply with one protected approval per run. Re-run Plan to verify absence of DRIFT.