Support mandatory files pushed to all repos without subscription

[MariusStorhaug]

Summary

Add support for mandatory files that are automatically synced to all organization repos, regardless of their Type or SubscribeTo property values.

Problem

The current model is entirely opt-in: repos must set SubscribeTo values to receive files. Some files should be enforced organization-wide (e.g., security policies, code of conduct, contribution guidelines) without requiring each repo to subscribe.

Proposed solution

Introduce a Repos/_Mandatory/ (or similar) folder whose contents are pushed to every repo in the organization:

Repos/
├── _Mandatory/
│   └── .github/
│       └── SECURITY.md
├── _Global/
│   └── ...
├── Module/
│   └── ...
└── ...

Behavior

• Files in _Mandatory/ are included in every repo's sync, unconditionally.
• No subscription is needed — if a repo has a Type set (or even if it doesn't), it receives mandatory files.
• Mandatory files are layered under subscribed files in precedence, so a repo's subscribed file set can still override a mandatory file if needed (or mandatory files always win — this is a design decision to make).

Scope consideration

Decide whether mandatory files apply to:

• All repos with a Type property set (i.e., repos that have opted into the Distributor system)
• All repos in the organization, period

The former is safer as a starting point to avoid touching repos not yet onboarded.

Acceptance criteria

• A _Mandatory/ (or agreed-upon name) folder under Repos/ is recognized by the workflow
• Files in _Mandatory/ are synced to all applicable repos without requiring SubscribeTo
• Define and document the precedence between mandatory, global, and type-specific files
• Define scope: all repos vs. only repos with Type set
• Update the spec and README to document the mandatory file convention