Ship settings as a weekly release, rolled out on publish

[gavinbee]

Closes #34

What & why

GitHub's inactivity rule switched reconcile-repo-defaults.yml off and it stayed off. The reconciler's whole effect was on other repositories, so it produced no event in this repo and could never reset the 60-day clock — nine successful Monday runs inside the quiet window did not count, because workflow runs are not repository activity. Disabling is per-workflow, so the repo-created dispatch died alongside the cron; that is how officials-admin came to exist with no org settings at all.

Split it in two, so neither half can go dormant:

• release.yml publishes a settings-YYYY-MM-DD release weekly, whether or not settings.yml changed. It is schedule-triggered, but publishing a release is repository activity, so it keeps its own clock reset the way swim-club-tech-survey does.
• rollout.yml checks out a released tag and applies it across the org. It carries no schedule, so inactivity disabling cannot reach the path that actually changes repos. Drift-catching and the repo-created hook move here.

release.yml dispatches the rollout explicitly rather than leaning on release: published, because an event raised by GITHUB_TOKEN starts no further workflow run. Cutting the release with the App token would also fix that, but only by adding Contents write across the whole org to a credential that only needs Administration.

apply-settings.py gains --version and --summary-file, so every rollout leaves a repo → result → version table. Nothing on a repo records which settings version it is on, which is why officials-admin went unnoticed for months.

Also closes the smaller note on the issue: create-repo.sh now prints the ghq get line for the layout docs/development.md documents.

Full rationale, alternatives and open items: docs/design/0003-settings-releases-and-rollout.md.

Testing

• ruff check . clean.
• pytest -q — 32 passed, including new coverage for summary_table and parse_args.
• Both new workflows parse as YAML; every run: block passes bash -n.
• bash -n scripts/create-repo.sh clean.

Not yet exercised end-to-end on GitHub — release.yml needs one workflow_dispatch after merge to publish the first tag and prove the handoff to rollout.yml.

Checklist

• Linked the issue this PR closes
• Tests added/updated and passing
• ruff check . clean (Python repos)
• Docs/README updated if user-facing behaviour changed

🤖 Generated with Claude Code

https://claude.ai/code/session_01CgLE8cg9huy2EZnRoXhmwp