ruleset-sync: an @consumers extra for the merge bot (MIP-0086 row 3)

[brunogbv]

Summary: ruleset-sync learns an @consumers key in bypass-extras.json, applied to every repo in .github/consumers.txt before that repo's own extras. The merge bot (marola-merge-bot, App 5257042) moves there from marola's own entry, so it becomes a pull-request-only bypass actor on every devkit consumer and on nothing else. Closes #100.

MIP	MIP-0086 §5.7, tasks row 3
Tested	✅ gates · ⬜ e2e · ⬜ live · ⬜ ci-only: ruleset-sync.sh --self-test red (unknown --consumers) then green; devkit quality gate run outside Nix (ruff 0.17.0 from a venv), so CI's run is the one that counts

What changed

• scripts/ruleset-sync.sh: --consumers FILE (default .github/consumers.txt), extras_of merges @consumers first and the repo's own extras last, so a repo's own mode for the same actor wins. Self-tests: a consumer gets the extra, a consumer without it reads as drift and apply adds it, a non-consumer never gets it, a consumer's own entry outranks @consumers.
• .github/rulesets/bypass-extras.json: marola's entry for 5257042 becomes the @consumers entry. marola keeps it because it is a consumer.
• docs/4-reference_tools.md: the ruleset-sync row mentions @consumers and --consumers.
• CHANGELOG.md: one line in the unreleased v0.9.0 entry.

Before anyone runs apply (the second half of row 3, a person's step after v0.9.0 is out):

apply is all or nothing per repo, and on five consumers it changes more than the merge bot. ruleset-sync check over the consumers with this branch reports, for marola-app, marola-site, marola-ml, marola-corpus and marola-oods: the missing 5257042 actor, and OrganizationAdmin plus RepositoryRole 5 live as always where the manifest says pull_request. main's script reports the same admin drift, so it predates this PR: v0.8.2 (#74) set the rule and rulesets-apply never reached these five. Applying ends direct admin pushes to main in those repos. Approve that knowingly.

Run apply from a devkit checkout at main or at v0.9.0. A consumer or the umbrella still pinned to v0.8.3 would apply the old extras file and strip 5257042 from the five again.

Read-only results with this branch, 2026-10-12:

$ scripts/ruleset-sync.sh check marola-dev/marola
ruleset-sync check: marola-dev/marola: ok

$ scripts/ruleset-sync.sh --dry-run apply $(grep -Ev '^\s*(#|$)' .github/consumers.txt)
ruleset-sync apply: marola-dev/marola: ok, nothing to do
ruleset-sync apply: marola-dev/marola-app: drifted — updating ruleset 24350712
ruleset-sync apply: marola-dev/marola-site: drifted — updating ruleset 24297035
ruleset-sync apply: marola-dev/marola-ml: drifted — updating ruleset 24350592
ruleset-sync apply: marola-dev/marola-corpus: drifted — updating ruleset 24335352
ruleset-sync apply: marola-dev/marola-oods: drifted — updating ruleset 24353210
ruleset-sync apply: 0 created, 5 updated, 1 ok, 0 failed (6 repos) (--dry-run: nothing was written)

This branch and mip-0086/2-bot-token both add a line to the v0.9.0 CHANGELOG entry; whichever merges second rebases.