GCSS-1135: Add support for GitHub repository environments

[dev-milos]

Summary

Adds support for managing GitHub repository environments (deployment protection rules, required reviewers, and deployment branch/tag policies) across the importer, the Terraform provisioning layer, the JSON schema, and the docs.

Continues the work from #28 (whose head lives on a fork we can't push to), rebased on top of current main with all conflicts resolved.

• Closes G-Research/gr-oss#1135
• Closes G-Research/gr-oss#1137

What changed

Importer (feature/github-repo-importer/)

• Imports existing GitHub environments (protection rules, reviewers, deployment policies) into the generated YAML.
• Gated behind an opt-in feature flag (default: disabled, backward compatible).

Terraform (feature/github-repo-provisioning/)

• github_repository_environment, plus github_repository_environment_deployment_policy for branch and tag patterns.
• These resources live in the vendored child module (modules/terraform-github-repository/), consistent with how every other per-repo sub-resource is already defined there (github_branch_protection, github_repository_collaborator, github_team_repository). The root module passes environments in and wires import blocks that address module.repository[...].github_repository_environment.environment[...].
• Reviewer slugs/usernames are resolved to numeric IDs via data.github_team / data.github_user.

Feature flag

Enable environment import by setting a flat top-level key in config/import-config.yaml:

# import-config.yaml
feature_github_environment: true

(The flags are collected via a yaml:",inline" map[string]bool, so they are flat keys — not a nested features: block.)

YAML configuration structure

environments:
  - environment: production
    wait_timer: 300            # minutes (max 43200 = 30 days)
    can_admins_bypass: false
    prevent_self_review: true
    reviewers:
      users: ["octocat"]
      teams: ["platform-team"]   # team must already have repo access
    deployment_policy:
      policy_type: protected_branches   # or selected_branches_and_tags

  - environment: staging
    deployment_policy:
      policy_type: selected_branches_and_tags
      branch_patterns: ["main", "release/*"]
      tag_patterns: ["v*"]

  - environment: development
    # no deployment_policy = any branch can deploy

JSON schema

• Environment / DeploymentPolicy structs carry jsonschema tags: environment required, wait_timer bounded 0..43200, policy_type restricted to the enum protected_branches | selected_branches_and_tags.
• Regenerated .schemas/repository-config.schema.json so environments: is a recognized, validated property (under additionalProperties: false the block would otherwise be rejected at validation time).

Known limitations

• Deployment policies require numeric policy IDs that can't be derived from YAML, so they are created fresh on first apply rather than imported; state converges on a second apply.
• Max 6 combined users + teams as reviewers (GitHub API limit).
• Reviewer teams must already have access to the repository.

References

• Terraform GitHub Provider — Repository Environment
• Terraform GitHub Provider — Deployment Policy
• GitHub API — Environments

[pavlovic-ivan]

LGTM