feat: allow forced repository sync file updates

[Jared Holgate (jaredfholgate)]

Summary

• add a workflow_dispatch-only force_file_update option that applies -Upgrade to the repositories selected by the existing filter
• remove the ineffective forced direct-collaborator removal input and implementation
• remove a conflicting root .avm file from the temporary clone before managed-file sync, allowing the same run to repair the repository
• add repository-sync contract and collaborator regression coverage

Validation

• ./build.ps1 pre-commit
• repository-management configuration test scripts

Failure addressed

The recurring failure in https://github.com/Azure/azure-verified-modules-tools/actions/runs/32234329971/job/96010930499 was caused by a root .avm file blocking creation of .avm/managed-files-version.json.

[github-code-quality]

Code Coverage Overview

Languages: PowerShell

PowerShell / code-coverage-agent

The overall line coverage in commit c4593d6 in the jaredfholgate-repo-s... branch remains at 89%, unchanged from commit e949907 in the main branch.

[github-actions]

Test results

   12 files  +  6    600 suites  +36   17m 39s ⏱️ + 12m 7s
1 053 tests + 22  1 051 ✅ + 20   2 💤 +2  0 ❌ ±0 
3 159 runs  +108  3 130 ✅ +102  29 💤 +6  0 ❌ ±0 

Results for commit c4593d6. ± Comparison against base commit e949907.

This pull request removes 16 and adds 38 tests. Note that renamed tests count towards both.

Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_Lock_interface",False)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_future_stable_interface",True)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_interface",False)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_lock_interface",True)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_private_endpoints_interface",True)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","deprecated_role_assignments_interface",True)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("notice","terraform_unused_declarations",False)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names("warning","deprecated_lock_interface",False)
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names(False,"notice","deprecated_Lock_interface")
Test-AvmDeprecatedInterfaceNotice.matches only notice-level AVM deprecated-interface rule names(False,"notice","deprecated_interface")
…

Integration: Invoke-AvmHttp against real upstream releases.downloads terraform-docs from GitHub and verifies the locked SHA256
Integration: TFLint AVM plugin attestation.installs and executes the pinned AVM ruleset with artifact attestation
Integration: avm command routes.finds the live PowerShell Gallery package as a module version
Integration: avm command routes.routes avm doctor --json and returns valid diagnostics without warnings
Integration: avm command routes.routes avm tool list with passthrough and returns every managed tool without warnings
Integration: avm command routes.routes avm version and returns the loaded module version without warnings
Integration: avm command routes.routes every help form without warnings("--help")
Integration: avm command routes.routes every help form without warnings("-h")
Integration: avm command routes.routes every help form without warnings("bare")
Integration: avm command routes.routes every help form without warnings("help")
…