Repin provider-upjet-github to the first release bundling terraform-provider-github >= 6.13.0 #2800

🤖 Generated with [Claude Code] (interactive session, at the maintainer's request)

Problem

The cluster runs provider-upjet-github v0.19.1, which bundles integrations/terraform-provider-github 6.6.0. That version is now the single gate on a batch of declarative GitHub coverage — see devantler-tech/.github#121 for the verified capability table.

Two concrete consequences today:

1. OrganizationRuleset + requiredStatusChecks panics on create — provider#289, fixed upstream by #295 (TF 6.13.0).
2. shaPinningRequired does not exist in the v0.19.1 CRD. The 16 RepositoryPermissions merged in .github#67 therefore cannot enforce anything — and when they reconcile against the current CRD the apiserver silently prunes the unknown field, so they would report Synced=True while enforcing nothing.

Gate

Provider main is 22 commits ahead of v0.19.1 and carries the fix, but no release has been cut (latest: v0.19.1, 2026-05-23). This issue is blocked on upstream cutting one.

What to do when a release lands

• Bump package: in k8s/providers/hetzner/infrastructure/crossplane/provider.yaml to the first release containing TF ≥ 6.13.0
• Confirm the provider goes Healthy=True and no already-active MRD regresses (the MRAP list itself needs no change — repositorypermissions.actions.github.m.upbound.io is already active)
• Verify kubectl get crd repositorypermissions.actions.github.m.upbound.io now exposes shaPinningRequired
• Hand off to .github#121 for the adoption work, which must verify live GitHub state, not just CR status

Rough size

S — a one-line pin bump plus verification. The waiting is external.

Blocks devantler-tech/.github#121.