Report security-control capability separately from state

[cervantesh]

Summary

• add per-control capability, enabled, status, reason, HTTP status, and bounded recovery results
• preserve legacy six-boolean state and top-level ok semantics
• distinguish enabled, disabled, omitted, forbidden, masked/not-found, and partial responses with deterministic fixtures
• document conservative masked-404 handling, migration guidance, and administrator recovery
• keep the offline workflow validator importable by the Windows Vitest suite by removing its unnecessary shebang

Compatibility decision

The additive controls result is authoritative for capability diagnostics. Legacy state booleans remain available, and ok remains their logical AND. A 404 is unknown with reason not_found_or_masked; it is never treated as proof that a control is unsupported or disabled. Configuration verification now requires an observable available state, so unknown capability cannot falsely verify a requested disabled value.

Validation

• npm ci
• npm run verify (9 files, 69 tests; coverage thresholds passed)
• npm audit --audit-level=high (0 vulnerabilities)
• npm pack --dry-run (63 packaged files)

Recovery and rollback

Recovery strings are static and sanitized; raw GitHub failure messages are not copied into results. Rollback is a normal revert of this PR; no persistence, migration, deployment, or release is involved.

Closes #46

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1468122e88

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve Dependabot’s disabled 404

For dependabotSecurityUpdates: false, GitHub documents GET /repos/{owner}/{repo}/automated-security-fixes returning 404 when Dependabot security updates are not enabled (https://docs.github.com/rest/repos/repos#check-if-dependabot-security-updates-are-enabled-for-a-repository). Because endpoint reads now share this 404 branch, a successful DELETE is converted to enabled: null/unknown instead of disabled; then configureRepositorySecurity can never mark that requested disable as verified. Please special-case the automated-security-fixes 404 as the documented disabled state where appropriate.

Useful? React with 👍 / 👎.