Org-wide asset register roll-up, scheduled daily (#116)

[ms280690]

Closes #116. Stacked on #165 (issue-115-asset-inventory) for the inventory schema and DOT renderer; retarget once that merges.

What

• .github/actions/asset-register/rollup.py (stdlib; imports the grouping and DOT code from the sibling asset-inventory/inventory.py): merges one inventory.json per repository into assets.json (per-repo rows with generated_at, stack_kind, counts, age_days, stale; every resource record with repo and unowned_reason), owners.md, unowned.md (tag violations, or a team-* owner not in policies/tags/teams.yml; @sparkgeo.com owners pass), data-classes.md (confidential and restricted only), register.dot/register.svg (nodes labelled with their repo), summary.md and SHA256SUMS. Unreadable inventories are skipped with a warning. Outputs repo-count, unowned-count, stale-count, summary-path; exit 0 always.
• policies/tags/teams.yml: starts as teams: [], which accepts any team-* owner; fill in the real team names after merge so unknown teams surface in unowned.md.
• Composite asset-register (installs graphviz if missing, uses the bundled team list by default).
• asset-register-rollup.yml: daily plus workflow_dispatch, this repo only, contents: write and issues: write. Mints a read-only token with actions/create-github-app-token (contents: read, metadata: read) from ASSET_REGISTER_APP_ID and ASSET_REGISTER_APP_PRIVATE_KEY, falling back to GITHUB_TOKEN with a warning (public repos only). Lists non-archived org repos, downloads inventory.json and SHA256SUMS from each asset-inventory-latest release, verifies with sha256sum -c --ignore-missing, runs the composite, publishes asset-register-latest and asset-register-YYYY-MM-DD (same recreate-and-prune shell as the threat-feeds mirror, 90 kept), and opens or comments on "Asset register: unowned or stale assets" while anything is unowned or stale, closing it on a clean run. zizmor's github-app audit is ignored on the owner: line with the reason: the register has to read every repository, and the token is read-only with the minimum two permissions.
• Docs: register format, auditor retrieval of a dated snapshot, and the App setup (org-admin item) in docs/asset-inventory.md; actions/create-github-app-token row in docs/approved-actions.md; README rows and section.
• CI Asset Register job: fixture suite plus the composite on the fixtures with output, SVG and checksum assertions.

Tests

tests/asset-register/run.sh: three fixture repositories (fresh and clean; fresh with a violation; 22 days old with an owner outside the team list and an email owner), merged counts and ordering, unowned reasons, stale warning, owners.md, unowned.md and data-classes.md rows, summary heading, DOT snapshot, SHA256SUMS round-trip, no team list, --stale-days 30, empty input, and a broken inventory.json.

Deferred

• Org admin: create the read-only App and the two secrets; fill policies/tags/teams.yml. First live run via workflow_dispatch after merge (empty register until repositories publish inventories through Asset inventory and tag-grouped diagram from plan and synth output (#115) #165).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF