docs: add .github maintainer README

[haasonsaas]

Summary

Adds a root maintainer README for the org-defaults repo and strengthens the Codex rails around shared metadata.

What changed

• Documented what lives in evalops/.github, how maintainers should change it, and how downstream repos adopt reusable workflows.
• Added .github/scripts/validate-services-catalog.rb to validate services.yaml shape, duplicate repos, enum values, depends_on references, and boolean flags.
• Added validator tests, including coverage for the current 71-service catalog.
• Updated codex-rails-check so changes to README.md and services.yaml trigger validation.
• Fixed the Ruby test command so every test/*_test.rb file is loaded; the prior command only executed the first expanded test file as the Ruby program.

Verification

• ruby .github/scripts/validate-services-catalog.rb services.yaml
• ruby -Itest -e 'ARGV.each { |path| require "./#{path}" }' test/*_test.rb
• actionlint .github/workflows/codex-rails-check.yml .github/workflows/agent-authorship-label.yml .github/workflow-templates/agent-authorship-labels.yml
• git diff --check

[cursor]

PR Summary

Medium Risk
Medium risk because it introduces new validation gates and changes the Ruby test invocation in codex-rails-check, which could fail downstream repos or alter CI behavior if assumptions differ.

Overview
Adds a new Ruby validator (.github/scripts/validate-services-catalog.rb) and Minitest coverage to enforce services.yaml structure (required fields, enum values, repo format/uniqueness, depends_on references, and boolean flags).

Updates codex-rails-check to run this validation when services.yaml exists (and to trigger on README.md/services.yaml changes), and fixes the Ruby test step to require all test/*_test.rb files instead of only executing the first. Also adds a root README.md and updates AGENTS.md with the new local verification commands.

^{Reviewed by Cursor Bugbot for commit 7c2bfbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 7c2bfbe. Configure here.}