ci(metadata): allow reviewed manual reconciliation

[seonghobae]

Outcome

This lane is closed rather than merged. Exact-head repository validation proved that adding workflow_dispatch to a central workflow violates the existing control-plane contract test_no_central_workflow_exposes_branch_selected_manual_dispatch, whose purpose is to ensure central manual entrypoints cannot load branch-selected code.

The metadata reconciler already has a trusted default-branch scheduled apply path. Repository-facing settings work should therefore converge through protected-main integration plus the existing schedule, while the dedicated credential repair (#1625) and workflow-backed Pages preservation repair (#1628) remain the owner-side capability fixes.

No governance or test was weakened to make manual dispatch pass. The failed head 085d1f111a13a346e76838ba8f52c958647888b0 is retained as evidence of the rejected design.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

Warning

Review limit reached

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3c5f2737-f290-4ba0-a4e4-280e508d5715

📥 Commits

Reviewing files that changed from the base of the PR and between 1ddc31f and 085d1f1.

📒 Files selected for processing (1)

• .github/workflows/repository-metadata-reconcile.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}