Guard repository destroys instead of blocking them outright

[NWarila]

A Terraform delete of github_repository is not necessarily a deletion.

archive_on_destroy defaults to true, and the provider's delete path sets archived = true and calls Edit rather than Delete — confirmed in the provider source:

archiveOnDestroy := d.Get("archive_on_destroy").(bool)
if archiveOnDestroy {
    if d.Get("archived").(bool) { return nil }   // already archived → no-op
    d.Set("archived", true)
    client.Repositories.Edit(ctx, owner, repoName, repoReq)   // ARCHIVE
}

So removing a definition archives the repository. The archive-then-delete-in-UI retirement path already existed.

Why prevent_destroy is not used

It would block the archive too — replacing a working retirement path with a hard plan error. It also can't help decide the interesting cases: it's a lifecycle meta-argument, must be a literal, and cannot read the before-state.

What the guard does

The plan shows delete for both an archive and a real deletion, so the plan alone can't distinguish them. The guard reads the before-state and splits the cases:

	Case	Why
refused	archive_on_destroy = false	the only genuinely irreversible path. Nothing sets it today
refused	repository not already archived	archiving as a side effect of a definition going missing — a bug signature, not a retirement
allowed	already-archived repo leaving config	provider no-ops, state forgets it. Blocking this would make retirement impossible
reported	non-repository destroys	rulesets and environments churn legitimately, but a destroy shouldn't scroll past unread

The case that matters in practice

On the-hero-wars-guys, a dotfile-blind glob (fixed in #94) dropped a definitions file and the plan proposed to archive .github — archived=false, public, the org profile repo. Archiving it makes it read-only and stops its Actions org-wide. Reversible, but an outage during a ramp.

That's the second rule, and it costs nothing: it only insists an archive be deliberate rather than a consequence of a file going missing.

Correction to this PR's earlier revision

The first version added prevent_destroy and described the incident as a repository deletion with no safety net. Both were wrong — archive_on_destroy was already the default, so it was an archive, and it was already a safety net.

Testing

tools/test_destroy_guard.py extracts the guard's Python from the workflow and executes it, so the tested code is the shipped code rather than a copy that can drift. 12 tests, including the real incident plan shape.

Two edge cases decide which way ambiguity falls, deliberately in opposite directions:

• absent archive_on_destroy → provider default applies → allow (assuming deletion would block ordinary retirements)
• null before-state → archived state unknown → refuse

Gate: 12/12 guard tests, 93/93 terraform tests, fmt and validate clean.