Scheduled org-wide puppetsync runs (continuous baseline enforcement)

Goal

Run puppetsync on a schedule (e.g. a cron-triggered GHA workflow) against the whole org, so the baseline is continuously enforced instead of enforced in occasional hand-driven sessions.

Prerequisites

This is the capstone on top of:

• #49 — full idempotency (no-change repos pass through cleanly)
• #50 — Renovate-resilient templates (scheduled runs must not clobber Renovate's version bumps)
• #55 — dynamic inventory from the GitHub API (so the schedule doesn't depend on hand-maintained repolists)
• #52 — no interactive debugger in the critical path (unattended runs must never hang)

Together those make "safe to run when nothing needs changing" true, which is exactly the property a scheduled run needs.

Sketch

• GHA workflow on this repo with a schedule: trigger (plus workflow_dispatch: for manual runs), running the sync plan against the org-wide dynamic inventory.
• Auth via a bot account token; pushes over HTTPS with the token (the push changes using HTTPS basic auth + GitHub token (CI friendly) stretch goal already noted in plans/init.pp).
• The run's three-bucket summary (PR'd / unchanged / failed) becomes the job output; failures should be loud (issue comment, Slack, or failed job).

Effectively this turns puppetsync into the same kind of continuously-running fleet manager that Renovate already is for dependencies, with the two dividing the labor: Renovate owns versions, puppetsync owns structure.

Start with plans/init.pp, especially the noted HTTPS basic-auth and GitHub-token path, then review the existing puppetsync flow and the prerequisite issues. Define the scheduled and manually dispatched GitHub Actions workflow around the dynamic org inventory, and use the PR'd, unchanged, and failed buckets as job output with loud failure handling.