Track master to main default branch migration #42

Convert cloudfoundry/jumpbox-deployment from default branch master to main, preserving repository history, other refs, release state, and effective protection. Preparation PRs are open; no default branches or deployed Concourse pipelines have been changed by this batch. This issue remains open through operator verification.

Related PRs:

• cloudfoundry/jumpbox-deployment — source preparation
• cloudfoundry/bosh-bootloader
• Shared community configuration (draft)

Sequencing and dependencies:

• Merge the bootloader PR and have its operator apply the read-only default-following jumpbox source before the rename. Its independent APT signing-key URL changes are safe on either side of that repository's rename.
• The repository's own pipeline writes to jumpbox-deployment. Keep its explicit main source and apply it only after main exists.
• Coordinate active writers before native rename, then have operators update every active writer/reader and verify they resolve to main. Do not run those pipelines' configure scripts automatically.
• Preserve Terraform state, environment branches, resource names, version history and repository tags. Do not alter deployment state to complete this source-branch migration.

Operator handoff and completion checklist:

• Merge the source preparation and the functional consumer changes above; record any inactive consumers and non-gating documentation follow-ups. Obtain operator confirmation that active downstream get-only resources follow the default branch before cutover.

• Immediately before rename, snapshot the default branch and its SHA, all branch/tag refs, effective branch protections/rulesets, open PR heads/bases, and relevant publisher/security integration settings. Ensure main does not already exist. Check for any prospective main protection-rule collision. Do not delete or weaken protection rules to force the operation; report any collision for explicit resolution.

• Coordinate active writers and the operator's pipeline cutover window. The agent must not pause, unpause, reconfigure, check resources, trigger jobs, or run configure scripts. Pipeline changes and runtime checks belong to the operator.

• After source merges and operator readiness, use GitHub's native rename (not copy/delete):

  gh api --hostname github.com --method POST \
    repos/cloudfoundry/jumpbox-deployment/branches/master/rename \
    -f new_name=main

• Verify default branch main, its SHA matches the final pre-rename master snapshot, master is absent, other branches/tags are unchanged, a fresh clone selects main, PR bases are correctly retargeted, and effective protection/ruleset policy is preserved. Use the fresh snapshot, since subsequent reviewed merges change the branch tip.

• Operator applies own/write sources selecting main and confirms every active consumer has the prepared selector. Record actual post-rename resource-version/get evidence without resetting version history or release counters. Record inactive consumers explicitly; do not activate them for this migration.

• Confirm any active publisher/security integrations follow main or the repository default. A check that is disabled/removed is not an active dependency; branch-neutral configuration needs no invented branch setting.

• Once all five repos in the shared draft have completed their GitHub cutovers and required operator checks, mark the community PR ready, merge it, and confirm the resulting configuration retains these defaults and policies. Keep this issue open until this repository's cutover evidence is recorded and the shared configuration is merged.

The merged community configuration must eventually be applied by a successful Peribolos synchronization containing it before the migration is fully complete. No specific long-running/canceled Peribolos job is a checklist gate.

If cutover fails, preserve the snapshots and report the precise blocker. Prefer fixing forward. A rollback requires coordinated operator changes, reviewed source reversions, and (if already merged) matching community config; rename main back to master only after confirming no new writes/history would be lost. Never silently recreate divergent branch aliases, force-push, delete protection rules, reset semver/state, or change deployed pipelines from the agent.

Validation already performed: whitespace checks; exact parsed pipeline comparisons; successful local YTT rendering and strict offline validation for all three stemcell branches; unchanged baseline validation outcomes for legacy templates; community generation confirms only these five defaults and four generated master-to-main protection selectors change, with the APT exception preserved. Preparation validation is not runtime verification.