feat(rulesets): narrow Copilot review to explicit repo+branch targets

[JacobPEvans-personal]

Summary

The Copilot review ruleset added in #60 was scoped via the gitflow
custom property — every one of the 9 gitflow-tagged repos, on develop,
and the set grows automatically as more repos opt into git-flow. That
ruleset was never applied (tofu apply was left as an explicit
operator step and never run — confirmed live via
gh api orgs/dryvist/rulesets, no ruleset with "copilot" in its name
exists on GitHub today).

The org has separately already run out of Copilot review capacity from
unrelated usage. gh api orgs/dryvist/copilot/billing confirms why
property-based scoping is the wrong shape for that: seat_breakdown.total = 0, so every review bills AI credits directly with no pooled allowance.
9 repos (and growing) is too broad a surface for a budget that's already
tight.

This replaces the property match with an explicit (branch, repo-list)
target model, starting with just ansible-proxmox-apps on develop.

Design

Mirrors merge-gate.tf's existing pattern — buckets keyed by a label,
for_each over buckets, repo list per bucket, decoded from a dedicated
config/*.yml — rather than inventing a new shape. Keyed by branch
this time (not check-context), since growing the pilot may mean a
different repo targeting a different branch, not just more repos on
develop:

# config/copilot-review.yml
copilot_review:
  develop:
    - ansible-proxmox-apps

resource "github_organization_ruleset" "org_copilot_review" {
  for_each = local.copilot_review_targets
  # ... conditions.ref_name = [refs/heads/${each.key}]
  # ... conditions.repository_name.include = each.value
}

Growing the pilot going forward is a one-line YAML edit, never a code
change or a broader property match.

Why this is a clean replacement, not a migration

Because the old ruleset was never applied, there's no live state to
migrate — no import, no moved block. The old resource
(org_gitflow_copilot_review in rulesets.tf) is deleted outright and
replaced by the new copilot-review.tf. The enforcement variable is
renamed org_gitflow_copilot_review_enforcement →
org_copilot_review_enforcement since it's no longer gitflow-tied —
safe, since Terraform variables aren't tracked in state.

Verification

• tofu fmt -check -recursive, tofu validate — both pass.
• tflint -f compact against v0.63.1 (the version CI resolves, via
  the signature = "pgp" pin from fix(ci): pin tflint plugin verification to pgp to unblock linting #61/chore(ci): pin tflint to v0.63.1 and hold upgrades for 60 days #64) — passes clean.
• Grepped for any remaining reference to the old resource/variable name —
  none.

Cost impact

Scope reduction, not a new cost source. #60 already declared the
per-review cost (AI credits, no pooled allowance, 0 assigned seats). This
PR narrows the blast radius from 9 repos (property match, grows
automatically) to 1 explicit repo, in direct response to the org already
exhausting Copilot review capacity from unrelated usage. tofu apply
(making any version of this live) remains an explicit, unrun operator
step — same as before.