chore(content)!: plan 1.x governance retirement

[zoeyrose]

Summary

• move content/1.x out of active maintenance governance into an exact immutable retirement record
• add a targeted fail-closed publisher mode whose plan contains only ruleset 20571870 deletion
• preserve the final branch tip, v1.8.19 rollback release/assets, and all default-branch and immutable-tag rulesets
• document separate organization-owner authorization gates for policy apply and later exact branch deletion

Safety boundary

This pull request changes desired state and plan tooling only. It does not apply GitHub governance, delete refs/heads/1.x, move a tag, edit a release, or remove an asset.

After merge, the live ruleset apply still requires a fresh preflight and explicit organization-owner authorization. Exact branch deletion requires another fresh preflight and a second, separate explicit authorization.

The live plan at the reviewed head is:

KEEP atrinik/content default branch is main
KEEP refs/heads/1.x is 080a9ea41741e4e67adc7b09b3ccb51475d93d3a
KEEP v1.8.19 is 566bd25f78b80b08d5f75f4b02017ab2429204db with exact recovery assets
KEEP no open pull request targets 1.x
PLAN DELETE /orgs/atrinik/rulesets/20571870

Validation

• bin/validate
• all tests/*.sh
• bash -n on changed shell scripts
• ShellCheck on changed shell scripts
• actionlint
• git diff main...HEAD --check
• live read-only bin/publish --retire-maintenance content/1.x
• downloaded v1.8.19 sha256sum --check SHA256SUMS
• live manual credential, GitHub App, and environment verification

Refs #64
Parent program: atrinik/atrinik#357

[github-actions]

🎉 This PR is included in version 2.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀