Drop the per-PR repository hygiene gate from the private repos

[ExtraToast]

What to build

Once the org-wide hygiene sweep is running on a public runner, remove the per-PR repository-hygiene.yml shim from the private repos it covers — fleet-infra and nix-config — for ~292 billable minutes/month.

Only remove the gate from repos the sweep genuinely covers, and only where the sweep's advisory posture was accepted in the parent ticket. Any repo that keeps hygiene as a blocking requirement keeps its shim.

Removing the workflow is not sufficient on its own: if Repository Hygiene is a required status check in a repo's ruleset, deleting the workflow leaves pull requests permanently unmergeable waiting for a context nothing will ever report. Update the ruleset in the same change.

Acceptance criteria

• repository-hygiene.yml removed only from repos the sweep covers and where advisory was accepted
• Repository Hygiene removed from the required status checks of every ruleset that named it
• A PR opened in each affected repo merges cleanly without waiting on a missing context — verify on a real PR
• Hygiene violations in those repos are still surfaced by the sweep

Blocked by

• Add an org-wide repository hygiene sweep that runs on a public runner github-workflows#123 — the sweep has to be covering these repos before their blocking gate is removed.

[ExtraToast]

Correction: the ruleset risk this issue describes does not exist.

The issue says removing the workflow would leave PRs unmergeable waiting on a required context, and to update the ruleset in the same change. No ruleset change is needed — Repository Hygiene was never a required check:

fleet-infra Main  -> required contexts: Pipeline Complete
nix-config  Main  -> required contexts: Pipeline Complete
GET /repos/{r}/branches/main/protection -> 404 Branch not protected  (both)

That also removes the 'advisory vs blocking' trade-off from the decision entirely — the guard already only reported. This is a clean ~292 min/month with nothing given up.

PRs: JorisJonkers-dev/fleet-infra#164 and JorisJonkers-dev/nix-config#28, plus the caller in #37. Each repo should come off the sweep's exclude-repos list when its PR merges.

[ExtraToast]

Done, and wider than this issue scoped. The per-PR guard is removed from fleet-infra#164, nix-config#28 and homelab-collections#14 — that last one was missed by this issue, which named only two repos, and was found by listing every private repo's active workflows rather than trusting the ticket.

No ruleset change was needed: Repository Hygiene was never a required check anywhere, so nothing was given up.

Follow-up landed in #41: fleet-infra and nix-config came off the sweep's exclude-repos list in the same breath, since the sweep is now their only hygiene coverage and leaving them excluded would have left them silently unchecked.

Hygiene sweep verified in production: 28 repos / 29 open PRs / 0 offenders before #41, 30 repos after.