Reconciles each repo's declared ci flag against whether it actually has
GitHub Actions workflow files on disk.
The gitops config derives ci from visibility (on for public repos, off for
private) with per-repo overrides; this check catches drift between that
declaration and reality —
a repo that claims CI but ships no workflow, or one that disclaims CI yet
still carries one. Repos that aren't checked out locally can't be judged, so
the caller marks them uncheckable and they're skipped. Archived repos are
frozen on their host, so their CI state is intentionally left alone and they're
skipped too.