org base permission is none, not read

[kans]

Fixes CXH-2100

This will drop 10s of millions of grants from some syncs.

Summary

• Fix false-positive repository pull grants under direct-collaborators-only: when GET /orgs/{org} omits default_repository_permission (common without org-owner / admin:org / Organization Administration visibility), stop inventing "read" and treat it as "none" instead.
• That fallback was expanding every org member onto every repo's pull entitlement via GrantExpandable, even when GitHub effective permission is "none".
• Warn when the field is missing so we can see that member→repo base-permission expansion was skipped.
• Org-admin → repo expansion is unchanged (owners still get admin on all repos).

Context

Reported on DoorDash (github_v2): C1 showed repo pull inherited from org membership for ~all members (~7.6k), while GET /repos/.../collaborators/{user}/permission returned "none". Root cause is the empty→"read" default in getOrgBasePermission.

[linear-code]

CXH-2100

[github-actions]

Connector PR Review: org base permission is none, not read

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 3b0fb854a9f9.
Review mode: full
Review run: https://github.com/ConductorOne/baton-github/actions/runs/29855432651

Review Summary

Scanned the full PR diff for security and correctness. This change fixes a false-positive grant bug: when the org GET endpoint omits default_repository_permission (common without org-owner / admin:org visibility), getOrgBasePermission now returns "none" instead of defaulting to "read", so orgBasePermissionToRepoPermissions returns nil and no org-member to repo pull expansion is emitted. Fail-closed behavior is correct, the Warn log is appropriate for a customer-visibility condition (per L1), imports for zap and ctxzap are already present, and the new table-driven test covers none, empty, read, write, and admin. Org-admin to repo expansion is unchanged. No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.