ghreport

Read-only org repo state report. Reuses ghsync's repo discovery (teams union org-repo-list) but, instead of cloning, queries each repo's remote GitHub state — open PRs, CI on the default branch, open security alerts (Dependabot / code-scanning / secret-scanning), and branch protection — and rolls it into a terminal summary plus a timestamped markdown file. Endpoints that need admin and return 403/404 are reported as…