ci: stop planning two settings GitHub does not keep

[lens0021]

The drift issue (#4) is down to one repository change that no apply can clear. After the ruleset
import landed and the maintainer applied, the plan on main reads:

Plan: 2 to import, 0 to add, 1 to change, 0 to destroy.

  ~ merge_commit_message                    = "PR_TITLE" -> "PR_BODY"
  ~ merge_commit_title                      = "MERGE_MESSAGE" -> "PR_TITLE"
  + ignore_vulnerability_alerts_during_read = false

A local tofu apply says "No changes" for the same configuration, because it compares against a
state file that kept the values it wrote. CI keeps no state: it imports and reads the repository
fresh every run, and gets the defaults back.

Why the values do not stick

allow_merge_commit = false, and GitHub does not keep a title or message for a merge method the
repository does not allow. The write is accepted and then forgotten, so it can be planned and
applied forever without ever being true. Squash is the only merge method allowed here and its
title and message are still set — nothing about how this repository merges changes.

ignore_vulnerability_alerts_during_read is not a repository setting at all: it is a (deprecated)
provider flag about how to read one. An imported resource never carries it, so every plan showed
it being set. It joins archive_on_destroy in ignore_changes, which is there for the same
reason.

Verifying

The plan this PR posts is the check: the repository resource should show no changes at all, and
the run on main after merging should close #4.

tofu fmt -check passes and tofu validate succeeds — with a deprecation warning for the
attribute named in ignore_changes, which is the attribute itself being deprecated upstream.

---

Generated by Claude Code

[github-actions]

OpenTofu Plan

github_repository.this: Refreshing state... [id=setup-mago]
github_repository_ruleset.default: Refreshing state... [id=20882589]

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

View run