fix: exclude private repositories from branch protections

[xnoto]

Summary

Excludes every repository in local.private_github_repositories from both standard and relaxed github_branch_protection resources.

This makes the policy explicit and future-proof: private personal repositories are outside the organization review policy, and GitHub Free cannot apply the configured branch restrictions to them. agent-knowledge remains private and receives no Terraform-managed branch protection.

Why now

The just-merged auto-merge setting change partially applied: kustomize-cluster.allow_auto_merge completed, then the apply failed trying to create relaxed protection for private agent-knowledge with:

Upgrade to GitHub Pro or make this repository public to enable this feature.

This PR removes the unsupported resource from the desired state, allowing the next environment-gated apply to converge successfully.

Expected plan

• No agent-knowledge branch-protection creation.
• kustomize-cluster.allow_auto_merge should already be converged from the partial apply; CI plan is authoritative for confirming that.
• No secrets, repository visibility, branch protections on public repositories, or GitHub App permissions change.

Follow-up

Once this root apply succeeds, charts PR #20 can merge. The next real opencode-server release will then prove that GitHub auto-merges the generated version-pin PR after kustomize-cluster test passes.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
--
No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and