grim7/14/2026, 3:50:51 AM

Product-safety floor. GitHub's install offers 'All repositories', and a synced
repo with no rule_configs runs the derived baseline gate — so installing on a
400-repo org would immediately block PRs everywhere with rules the maintainer
never chose. In prod, 4 synced repos were all being gated; only dither-kit was
intended.

- repos.armed bool NOT NULL DEFAULT false (migration 0003) — every existing repo,
  prod's four included, becomes unarmed; the owner re-arms deliberately.
- setRepoArmed is the ONLY writer; ensureRepo/syncInstallationRepos never touch
  armed, so re-sync/reinstall preserves the choice.
- runWorkflows skips an unarmed repo right after the repo fetch: no run/check/
  comment/action rows (the exemption shape), logged, before any forge reads.
- Events STILL ingest + normalize for unarmed repos — the append-only store stays
  complete for arm-time backfill (Unit 3). Proven by a dedicated test.
- armed surfaced on RepoLite for the UI; ensureDemoRepo arms demo repos so
  dev:demo is unbroken.

Checks: typecheck all, biome, boundaries, 239/239.

Parent461c615