docs: the org is rebase-only, not merge-only — correct ORG_STANDARDS and the README

[Bryan Fawcett (bryanfawcett)]

ORG_STANDARDS.md said "Squash merging and rebase merging are disabled on all
nine repos. allow_merge_commit is true everywhere", and said it with a
"verified on each repo individually" note attached, which is exactly what makes
it dangerous. Re-read off the API on 2026-09-12, all nine repos report:

allow_rebase_merge true (was false)
allow_merge_commit false (was true)
allow_squash_merge false (unchanged)
allow_auto_merge true (was true on three of nine)

The same holds on all 75 repositories in the Bundu Foundation enterprise, so
this is an estate-wide change rather than something done to this org. The
document's merge instruction, gh pr merge <n> --merge, is now the command the
settings reject.

Corrected, each marked with the date:

• "The merge-only convention" is rewritten as "The merge convention". The
  MIGRATION.md §1.1 argument is kept and re-read honestly: it argued against
  squash, squash is still off, and rebase preserves per-commit reasoning. What
  is lost is the merge commit, so merge_commit_title/message are now vestigial
  and a PR-title lint guards nothing in the history.
• Gap 4 — "mzizi-registry's ruleset contradicts the merge-only convention" — is
  resolved by the org moving rather than by anyone fixing it. required_linear_
  history and rebase merges agree. The fix the gap proposed, allowed_merge_
  methods: ["merge"], would now be the wrong change, and
  github-rulesets/org-wide-main-protection.json still contains it.
• "Branch protection and rulesets" said GET /orgs/mzizi-dev/rulesets returns
  []. It returns two: org-status-checks (active, requires the five lint / *
  contexts on every default branch, strict policy) and enterprise-main-
  protection (evaluate). Gap 8 is overtaken by the first of those.
• The repo table called mzizi-site "completely empty — no commits at all" and
  mzizi-docs and mzizi-roadmap README-only. All three now carry content and CI,
  and mzizi-site serves the mzizi.dev apex — which the table also recorded as
  mzizi-registry's, and which is now false. A dated note records the cutover,
  the surfaces it took offline, and the three pull requests that should have
  preceded it.
• Gap 11: mzizi-roadmap's README calls itself archived; the API reports
  archived: false. The gap now names the one call that would make the README
  true.
• Gaps 10 and 12 and the settings table re-read against the API.

Added, per the brief:

• README.md and ORG_STANDARDS.md both point at the estate-wide README standard
  at docs: add the estate-wide README standard nyuchi/.github#62, noting it is open and unmerged so the blob link would
  404, and summarising the branding facts it carries — 21 colour families not
  five or seven, the DNA double helix with axis/axes/layer retired, no database
  behind the registry, and docs.mzizi.dev not resolving.
• README.md gains the standard shape: blockquote purpose, CI and lint badges
  (both curled), an at-a-glance line and a licence section stating honestly
  that this repo carries no licence file.

Gaps 3 and 5 were re-checked and are unchanged: private vulnerability reporting
is still enabled only on mzizi and mzizi-registry, and secret scanning only on
mzizi-registry and mzizi-api-gateway.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com