Generate the Qodo Settings Repository From the Hub So Fleet Rules Are Authored Once and Auditable

[ptr727]

Follow-up from #1321, whose decision is recorded at
#1321 (comment). The maintainer
picked Option 1 plus the Qodo half of Option 2, after the measurement that made the Qodo half
decidable.

What was proved

A global pr-agent-settings repository under the account owner is honored for a personal account,
which Qodo documents as an organization-level feature. Both halves were measured on
ptr727/PlexCleaner#959:

• a setting in the global .pr_agent.toml reaches the review, proved by flipping
  use_images_and_animations and observing the same comment re-render four times, and
• a declarative rule in codebase_standards/global/pr_compliance_checklist.yaml is enforced on a
  repository that carries no checklist of its own, proved by a Rule violations (1) finding naming
  a rule title that exists only in the settings repository.

The repository used for the measurement was deleted once it had answered, deliberately, so that
no hand-written settings repository exists to conflict with the generated one this issue calls for.
Nothing is lost by that: the layout, the fixed folder names and both proofs are recorded here and in
the #1321 comment linked above. The generator creates the repository, which is an outward-facing
write needing the maintainer's permission at the time.

The work

Generate the settings repository from the hub the way the skills trees are generated, so the rules
are authored once in the hub, applied to every repository under the owner, and auditable from git.

• Decide which rules belong in a compliance checklist. A rule must be declarative. An
  instruction telling the reviewer to emit a particular finding is refused as a way to fabricate
  findings, which the measurement observed directly.
• Add a generator, following the pattern scripts/build_dist.py uses for the carried skills trees,
  producing codebase_standards/ and the root metadata.yaml that maps a repository to the folders
  applying to it. The names codebase_standards, global and groups are fixed by Qodo.
• Add an audit check so the settings repository is measured against its generated form, in the same
  way a carried tree is.
• Record the repository in registry/repos.json if a settings repository is a kind the registry
  should know about, which is a question this issue should settle rather than assume.

What bounds it

Qodo currently reviews one repository in this fleet. The paid identity is billing-blocked across
the account and the free identity is star-gated, so the enforcement this buys today reaches
PlexCleaner and nothing else. That does not change the design, and it does change how much the
work is worth doing first.

Relates #1321.