Adoption never sets the two repo settings baselining depends on — add them to bootstrap (both are scriptable)

[missingbulb]

Baselining's delivery depends on two repository settings that nothing in adoption ever sets, checks, or mentions. packs/grow_with_claudinite/skills/adopt-claudinite/SKILL.md has zero references to either — the only mentions anywhere in the corpus are the error strings added by #585.

Both are the direct cause of the two-day fleet stall.

The settings

Setting	UI	API
Allow GitHub Actions to create and approve pull requests	Settings → Actions → General	PUT /repos/{owner}/{repo}/actions/permissions/workflow → {"can_approve_pull_request_reviews": true}
Allow auto-merge	Settings → General → Pull Requests	PATCH /repos/{owner}/{repo} → {"allow_auto_merge": true}

Both are readable and writable by script — plain REST, no UI-only step. The matching GET on each returns the current value, so a conformance check could assert them rather than only bootstrap setting them.

The constraint is the credential, not the API: both require admin on the repo. The Actions GITHUB_TOKEN cannot do it, so this cannot be self-healed by baselining from inside the member. It belongs to either:

• adoption (adopt-claudinite), which already runs in a session with the owner's own credentials, or
• the sheepdog pack, whose FLEET_GITHUB_TOKEN spans the account — it could converge both settings fleet-wide alongside fleet-freshness, and would catch a repo whose settings were later flipped back.

The second is the stronger option: adoption sets it once, whereas the sheepdog sweep keeps it true.

Why it matters

Without the first, the maintenance PR is never created (#585 — silent before that fix, loud after). Without the second, an auto-merge member's PR opens and never lands. Neither is visible from inside the member repo, and neither produced any signal until it was investigated by hand.

Suggested scope

1. Adoption sets both over the owner's credentials, and records what it set.
2. A check (or the sheepdog freshness sweep) asserts both remain true, reporting the exact API path when they are not.
3. adopt-claudinite documents them, so a hand-adopted repo does not silently miss them.