chore: make .github private and verify all org integrations

[wcmchenry3-stack]

Context

The .github meta-repo is currently public, exposing internal workflow logic, Claude Code hook scripts, policy enforcement configs, and org-internal automation details. Once all prep work is complete, the repo can safely be made private.

GitHub's auto-serving of community health files requires a public .github repo, but this org already bypasses that via sync-community-health.yml (explicit push to each target repo). Going private is safe because:

1. Community health files are explicitly synced — no dependency on public serving
2. Reusable workflows (workflow_call) work from private repos in the same org
3. Scheduled workflows continue running from private repos
4. A public profile repo will serve the org homepage

Pre-conditions (all must be complete before this issue)

• chore: remove redundant root-level community health files #78 — root-level community health files removed
• feat: add CODE_OF_CONDUCT.md to community-health and sync #79 — CODE_OF_CONDUCT.md added and synced
• feat: add CONTRIBUTING.md to community-health and sync #80 — CONTRIBUTING.md added and synced
• feat: add SUPPORT.md to community-health and sync #81 — SUPPORT.md added and synced
• feat: add CODEOWNERS to .github/ #82 — CODEOWNERS added
• feat: add dependabot.yml to .github/ #83 — dependabot.yml added
• feat: expand sync FILE_MAP to include all Claude Code agents and hooks #84 — sync FILE_MAP expanded to include all Claude Code hooks and agents
• docs: update README.md to reflect sync architecture #85 — README updated to reflect sync architecture
• feat: create public wcmchenry3-stack/profile repo for org homepage #86 — public profile repo created and org homepage verified
• feat: add audit script to discover unsynced Claude Code content in org repos #87 — audit completed (recommended)
• chore: consolidate org-common Claude Code content from audit #88 — Claude Code content consolidated (recommended)

Implementation

1. Change repo visibility to private

   • Go to repo Settings → Danger Zone → Change repository visibility → Private
   • Or via: gh repo edit wcmchenry3-stack/.github --visibility private

2. Verify org homepage — visit https://github.com/wcmchenry3-stack

   • Should show wcmchenry3-stack/profile README content (not blank)

3. Verify reusable workflows — open a test PR in gaming_app or book_app

   • commitlint.yml should fire (tests workflow_call from private repo)
   • All other called workflows should fire normally

4. Verify community health sync — trigger sync-community-health.yml via workflow_dispatch

   • Should open PRs in all 6 target repos
   • COMMUNITY_HEALTH_SYNC_PAT should still be valid (visibility change does not invalidate PATs)

5. Verify scheduled workflows — check Actions tab

   • All scheduled-* workflows should still appear in the queue

6. Verify Claude Code gates — in a target repo, run gh pr create

   • lint-gate.sh should fire (via PreToolUse hook)
   • policy-gate.sh should fire

7. Document any regressions — if any workflow breaks, open a follow-up issue before declaring done

Acceptance Criteria

• Repo visibility changed to private
• https://github.com/wcmchenry3-stack shows profile README (not blank)
• Test PR in a target repo triggers commitlint.yml successfully
• sync-community-health.yml runs successfully post-visibility change
• All scheduled workflows still appear queued in Actions tab
• gh pr create in a target repo triggers lint-gate and policy-gate hooks
• No regressions — all org integrations verified working

Dependencies

BLOCKED by: #78, #79, #80, #81, #82, #83, #84, #85, #86
Recommended: #87, #88

Part of Epic

#77

[wcmchenry3-stack]

Gap found during pre-flight audit — add to Implementation steps

Missing step: set Actions access policy immediately after going private.

When the repo flips to private, GitHub defaults the workflow access policy to `none`, which means reusable `workflow_call` references from other repos will fail. All 6 project repo CI pipelines reference `wcmchenry3-stack/.github/.github/workflows/called-*.yml@main` and will break instantly without this.

Add as step 1b (right after changing visibility):

```bash
gh api --method PUT repos/wcmchenry3-stack/.github/actions/permissions/access
--field access_level=organization
```

Or in the GitHub UI: .github repo → Settings → Actions → General → Access → Accessible from repositories in this organization.

This must be done before any PR is opened in any project repo post-visibility change.