feat(estate): classify a repository by its account, not by being a fork

[rldyourmnd]

The owner decided on 2026-09-10 that GDS carries no fork concept. Whether GitHub calls a repository a fork describes how it was created, not who is responsible for it — so it stops being a classification, and a repository belongs to the account that holds it.

• core/estate/compiler.go — owner classification is the single fallback, and selector matching no longer reads match.fork.
• core/validation/estate.go — GDS_ESTATE_SELECTOR_PORTFOLIO_MISMATCH was keyed on match.fork being present. Dropping that field would have silently retired the check, so the rule is re-keyed on what it always meant: a selector that does not narrow by name, visibility or lifecycle is the owner's general one and must assign the owner's declared portfolio.
• schemas/v1/owner.schema.json — fork_portfolio is no longer required. It stays accepted so existing configurations remain valid; nothing reads it any more.
• policies/portfolios/fork-default.yaml and the fork selectors, owner fork_portfolio entries, fork: match clauses and forks workspace roots leave the fixture estate.
• core/assurance — the bounded-evidence invariant was "N repositories landed in a fork portfolio", a count that would now be zero forever and prove nothing. It asserts instead that every fork is classified like any other repository of its account: matched by a selector, carrying a portfolio.

One consequence worth naming. Organization forks become managed, because a managed account now manages everything it holds and a fork is no longer a way to sit outside that. NDDev-it-com and NDDev-OpenNetwork hold zero forks today, so nothing changes in practice — the compiler test asserts it deliberately.

Sequencing: the private estate must not carry fork selectors when this lands, or its general and fork selectors collide at equal priority. NDDev-it-com/github-device-sync-estate#557 removes them and validates cleanly under both the current release and this change, so it can land first and independently. Verified with both in place: scripts/validate_go_core.sh --quick exits 0, 66 packages ok.

https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX