fix(aws): reconcile the default branch to main

[devantler]

🤖 Generated by the Daily AI Engineer

Why

devantler-tech/aws still defaults to the bootstrap branch even though main is the released source of truth. New clones and repository links therefore land on stale configuration.

What

• add a namespaced DefaultBranch managed resource for aws
• import the existing repository and reconcile its default to main
• permit observe/create/update/late-initialize while explicitly excluding delete
• use the dedicated resource instead of the deprecated Repository.defaultBranch field

Validation

• red/green structural assertion for the rendered AWS default-branch resource
• kubectl kustomize deploy/
• kubectl --context admin@prod apply --dry-run=server -f deploy/repositories/aws.yaml
• live CRD schema check for repo.github.m.upbound.io/v1alpha1 DefaultBranch
• git diff --check
• independent read-only review: no actionable findings

Notes

The live repository currently reports claude/aws-config-tenant-scaffold as its default. Reconciliation after release should switch it to the already-existing main branch without changing any unrelated repository settings.

Fixes #89

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a Crossplane DefaultBranch resource for the aws GitHub repository. The resource targets the repository through its external name, configures main as the default branch, uses create, update, observe, and late-initialize management policies, and references the default ProviderConfig. The existing repository resource remains unchanged.

Possibly related PRs

• devantler-tech/.github#82: Adds the related Repository resource for the same AWS GitHub repository.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR declares the AWS default branch as main with a declarative managed resource and no unrelated repository setting changes.
Out of Scope Changes check	✅ Passed	The only change is the AWS default-branch manifest, which stays within the stated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: reconciling the AWS repository default branch to main.
Description check	✅ Passed	The description matches the changeset and explains the default-branch reconciliation, implementation, and validation steps.

---

_{Comment @coderabbitai help to get the list of available commands.}