fix(skill): correct the GHAS budget hard-stop procedure, which could not run

[seoseo-ai]

Problem

Step 7 of github-metered-billing-leak-diagnosis — the skill's only mutating
step — shipped a gh api call that cannot succeed against the live API:

gh api -X POST "/organizations/$ORG/settings/billing/budgets" \
  -f budget_amount=0 -F prevent_further_usage=true

Every required body field is missing (budget_type, budget_product_sku,
budget_scope, budget_entity_name, budget_alerting), so this returns
400 Missing required fields. Supplying them under the implied
ProductPricing + ghas combination then returns 500 — GHAS budgets are
accepted only at SkuPricing granularity.

The correct procedure was already established empirically in session
c8d15a6c (2026-08-24), which hit three separate API rejections before
creating both GHAS license budgets successfully. That evidence never reached
the skill file; the skill was written from the same session but encoded the
first, failing attempt.

Changes

Step 7 replaced with the verified procedure. Loops over both
ghas_secret_protection_licenses and ghas_code_security_licenses — GHAS
bills as two license SKUs and capping one leaves the other accruing. The
generated JSON body is byte-identical to the request that returned
Budget successfully created. on 08-24. A pre-check listing existing budgets
was added ahead of it.

Trap 5 added, covering the three rejections in order:

• the stop flag is prevent_further_usage, not
  stop_usage_when_budget_exhausted;
• the ProductPricing + ghas 500 text — "High watermark products cannot
  have PreventFurtherUsage budget alerting except for GHAS SKUs" — reads as
  permission, not refusal;
• budget_amount counts licenses, not dollars, for license-based
  products. GitHub's parameter doc: "The budget amount in whole dollars. For
  license-based products, this represents the number of licenses." So
  budget_amount: 0 means zero seats, not zero spend.

SKU-enumeration technique documented. Posting a deliberately invalid SKU
makes the API return the full valid-SKU list, which is how
ghas_secret_protection_licenses was found. Flagged explicitly as a POST that
leaves the otherwise read-only path, even though it creates nothing.

Safety section corrected. It previously described the hard stop in dollar
terms and did not list the enumeration probe among the mutating operations.

Verification

• bash -n on the step 7 snippet passes
• the jq-generated body matches the 08-24 success byte for byte
• autoinstall.sh no-headings lint passes
• repo copy confirmed identical to the installed copy before this patch, so
  the diff contains nothing else

Note

Sources are the origin session transcript and the current GitHub REST budgets
documentation. The SKU names and the 500 error text are quoted from a live
jinwon-int response, so they reflect that org's plan; the docs confirm the
general rule.

🤖 Generated with Claude Code

[jinon86]

Approved after explicit operator authorization using the Seoseo-held jinon86 credential.