createFoundryPrincipals.ps1 should declare the .github-private main-ref federated credential

[plamber]

elagents-p-foundry-ci now carries a hand-created federated credential github--github-private-main (subject repo:EasyLife365/.github-private:ref:refs/heads/main, created 2026-10-01 by @plamber for the scheduled Drift Check, see EasyLife365/.github-private#235 / PR #237).

createFoundryPrincipals.ps1 only creates and reconciles repo:<org>/<repo>:pull_request subjects and leaves every other shape untouched, so nothing declares this credential and a rebuild of the app would not recreate it.

Acceptance criteria

• The script declares non-pull_request subjects (e.g. a -MainRefRepos list) and creates the missing ones
• -RemoveOrphaned still never touches a declared main-ref credential
• Running it against the live app reports github--github-private-main as already present

[plamber]

No longer needed: the Drift Check workflow that required the main-ref credential is being removed (EasyLife365/.github-private#239).