chore: remove duplicate repo-settings tooling and deprecation markers

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: agjs

apps/api/.github/desired-repo-settings.json

@@ -56,10 +56,10 @@ The `main` branch on every BoringStack template repo enforces:
 - Conversations must resolve before merge
 
 Repo-level settings (secret scanning, push protection, Dependabot
-security updates, merge prefs) are described in
-`.github/desired-repo-settings.json`. The `scripts/ci/audit-repo-settings.sh`
-script diffs that against the live GitHub API and prints copy-pasteable
-fix commands — no auto-apply.
+security updates, merge prefs) are described in the monorepo root
+`.github/desired-repo-settings.json`. Run `./scripts/audit-repo-settings.sh`
+from the repo root to diff that file against the live GitHub API and print
+copy-pasteable fix commands — no auto-apply.
 
 ## Agent-driven review
 

apps/api/SECURITY.md

@@ -48,10 +48,10 @@ const spec: unknown = new Function("return " + precompiledCode)();
 
 ## Repo settings drift detector
 
-`scripts/ci/audit-repo-settings.sh` reads `.github/desired-repo-settings.json`,
-diffs against the live GitHub API, and prints copy-pasteable `gh api`
-commands for any drift. It auto-applies nothing. Run it after anyone
-touches repo settings in the GitHub UI.
+The monorepo root `./scripts/audit-repo-settings.sh` reads
+`.github/desired-repo-settings.json`, diffs against the live GitHub API,
+and prints copy-pasteable `gh api` commands for any drift. It auto-applies
+nothing. Run it after anyone touches repo settings in the GitHub UI.
 
 Desired state (enforced on every repo):
 

apps/api/docs/agents/security-pipeline.md

@@ -8,7 +8,7 @@ When you add a `package.json` script that runs a file under `scripts/`, update t
 
 | Folder                     | Purpose                                                 |
 | -------------------------- | ------------------------------------------------------- |
-| [`ci/`](ci/)               | Pre-push gate, CI manifest, GitHub settings audit       |
+| [`ci/`](ci/)               | Pre-push gate, CI manifest                              |
 | [`dev/`](dev/)             | Local developer workflow guards                         |
 | [`codegen/`](codegen/)     | Scaffolding, ACL type sync, VAPID key generation        |
 | [`db/`](db/)               | Database seed utilities                                 |
@@ -47,6 +47,5 @@ When you add a `package.json` script that runs a file under `scripts/`, update t
 
 ## Manual / operator
 
-| Task                             | Script                      |
-| -------------------------------- | --------------------------- |
-| Audit GitHub repo settings drift | `ci/audit-repo-settings.sh` |
+See the monorepo root `scripts/audit-repo-settings.sh` to audit GitHub repo
+settings drift against `.github/desired-repo-settings.json`.