[taraxvoid]

Adds .github/workflows/rulesets-drift.yml, which runs bun scripts/apply-rulesets.ts --check and writes the plan to the job summary.

• Triggers: weekly (Mon 06:17 UTC), workflow_dispatch, and PRs touching rulesets/**, the script, its config lib, or the workflow itself (same-repo PRs only, since forks get no secrets).
• Read-only: only --check is ever run, never --apply or --prune.
• Auth: actions/create-github-app-token with permission-administration: read, scoped to the five managed repos.
• CONTRIBUTING.md notes the workflow.

Needs a manual step before it can go green

I reused the release-bot App (RELEASE_BOT_CLIENT_ID / RELEASE_BOT_APP_PRIVATE_KEY) rather than creating a second App. I could not check its permissions from here. Its settings must grant Administration: Read and the installation must cover queeromaha, soundry, synthomaha, taraxvoid.net and voidflow, otherwise the token step fails. If you would rather keep release-bot narrow, a separate read-only App is a swap of the two secret names.

A PR that changes rulesets/ will show drift in its run until it is merged and applied, so read the summary rather than the colour there.

Not yet verified in Actions: the workflow has not run. After the App permission is in place, run it via workflow_dispatch on this branch. Done criterion from the issue (a hand edit turns the run red with the diff in the summary) can be checked by editing a ruleset by hand and re-dispatching.

Closes #166

🤖 Generated with Claude Code