Audit Launchplane authorization authority across integrated repositories

[shiny-code-bot]

Objective

Audit every active Launchplane-related repository for workflow-, secret-, checked-in-, or skill-mediated authorization authority that conflicts with the DB-native direction in #2058.

Current Status

State: Proposed as an active child of #2058 after the repairshopr recovery work repeatedly routed a narrow read gap toward another protected managed-set workflow.

Scope

• Inventory active product, tenant, shared, infrastructure, and agent repositories that integrate with Launchplane.
• Search workflows, actions, scripts, AGENTS.md, .github/github.json, docs, tests, examples, and secrets/variable documentation for authorization setup, managed-set reconciliation, policy-grant writes, bootstrap bridges, and product-local authority.
• Classify each surface as runtime authority, desired configuration, bootstrap, break-glass, transport, compatibility, generated projection, stale documentation, or dead code.
• Identify places where GitHub secrets or workflows effectively own routine application permissions despite Launchplane DB being the live authority.
• Remove stale guidance and dead integration code where safe; record migration blockers where removal depends on Design DB-native Launchplane access administration and migration #2061.
• Keep private values, repository secrets, live policy payloads, and provider topology out of public findings.

Acceptance Criteria

• Every active Launchplane-integrated repository has a pinned-SHA audit record and disposition.
• No product repository instructs operators or agents to create routine Launchplane permissions through product-local workflows or checked-in config.
• Remaining workflow/secret surfaces are explicitly classified as temporary bootstrap/break-glass or blocked on the DB-native migration.
• Repository instructions and metadata consistently route new authorization needs to Audit and redesign Launchplane authentication and authorization #2058 rather than creating another managed set.
• Findings are linked to concrete cleanup PRs or explicit migration blockers.

Finish Line

The active portfolio contains no unclassified or accidental workflow-, secret-, repository-, or skill-owned Launchplane authorization authority.