Consolidate the two file-driven apply-rulesets appliers into one (cross-repo bootstrap story)

[don-petry]

Context

After #580 / #590, petry-projects/.github owns the canonical file-driven apply-rulesets.sh (reads the local standards/rulesets/*.json). But petry-projects/.github-private still has its own file-driven applier (#1013) used by bootstrap-new-repo.sh (applies the fleet rulesets to new repos) and for its repo-local release-channel-tags.

Both read the same codified source (the .github-private one fetches standards/rulesets/ from .github), so there is no divergence — but the applier logic is physically duplicated across the two repos.

The task

Collapse to a single physical applier. The blocker is the "cross-repo bootstrap story": bootstrap-new-repo.sh runs in the .github-private checkout and needs to apply the fleet rulesets, but the canonical applier + JSONs live in .github. Options to evaluate:

• bootstrap fetches/execs .github's applier at runtime (via gh api contents), or
• a thin .github-private shim that delegates to the canonical one, keeping only release-channel-tags local, or
• vendor the applier into the repo-template/bootstrap flow.

This is the follow-up #583's annotation and #1013's PR body both flagged as deferred.

Refs: #575, #580, #590, petry-projects/.github-private#1013.