chore(governance): stop declaring repository identity in settings.yml

probot/settings applies this file on every push to the default branch, so `name`,
`description`, `homepage` and `private` here are instructions, not documentation. The estate has
already paid for that: the template carried `name: "{{REPO}}"`, GitHub collapsed the illegal braces
to dashes, the repo renamed itself to `-REPO-` on every push and its old URL 404'd.

This file now matches the template's own header and rule, with the four identity keys removed and
everything else left as it was. Repository identity and visibility are set out of band, once, by
the owner. Enforced by scripts/check-no-placeholders.sh.

Author: hyperpolymath

.github/settings.yml

@@ -7,15 +7,45 @@
 # applied by the probot/settings app when changes are pushed to the default
 # branch. Install the app at: https://github.com/apps/settings
 #
-# Template file — replace rattlescript and Python-syntax AffineScript — write Python-style code, get affine resource guarantees and typed WASM with actual values.
+# ─── THIS FILE MUST NEVER DECLARE REPOSITORY IDENTITY ─────────────────────────
+#
+# It carries NO `name`, `description`, `homepage` or `private` key, and it must
+# never gain one. The reason is a real incident, not a hypothetical:
+#
+#   This file previously read `name: "{{REPO}}"`. probot/settings applies it on
+#   every push to the default branch, so it submitted the literal string
+#   `{{REPO}}` as the repository name. GitHub sanitises an invalid name by
+#   collapsing each run of illegal characters to a dash — `{{REPO}}` became
+#   `-REPO-`. The template renamed itself on every push, its old URL 404'd, and
+#   it was mistaken for a deleted repository. `description` was likewise left
+#   reading the literal `{{DESCRIPTION}}` on the live repo.
+#
+# Two properties make identity keys unsafe here specifically:
+#
+#   1. This is a TEMPLATE. `just repo-init` fills placeholders in repos minted by the
+#      scaffolder — but GitHub's "Use this template" button copies the default
+#      branch verbatim and never runs `just repo-init`. Any placeholder left in a
+#      probot-managed file therefore reaches children unrendered.
+#   2. Identity is not shareable. The template must be public while children
+#      default private; a child cannot inherit either `name` or `private` from
+#      its parent without being wrong.
+#
+# Repository identity and visibility are therefore set OUT OF BAND: once per
+# repo, at creation time, by the operator (the Configure stage of ADR-0003).
+# `just repo-init` deliberately runs NO `gh` commands — it prints the exact
+# `gh repo edit` commands as next steps instead. Fail-closed default: repos
+# stay private unless the owner flips visibility deliberately; the template's
+# own name and visibility are set deliberately by the owner.
+#
+# Everything below is safe to inherit: it is true of every RSR repo regardless
+# of that repo's name, purpose or visibility.
+#
+# Enforced by `scripts/check-no-placeholders.sh`, which fails if this file
+# contains a `{{` token or declares any of the four identity keys.
 
 # ─── Repository Settings ───────────────────────────────────────────────────────
 
 repository:
-  name: "rattlescript"
-  description: "Python-syntax AffineScript — write Python-style code, get affine resource guarantees and typed WASM"
-  homepage: "https://github.com/hyperpolymath/rattlescript"
-  private: false
   has_issues: true
   has_projects: true
   has_wiki: false