ci: notify when public T3 Code advances

[murraci]

What

Adds a notification-only GitHub Actions workflow that compares TCM's default branch with
pingdotgg/t3code every day and maintains one assigned issue when public upstream advances.

The notification hands acceptance back to the existing local T3 workflow:

1. fetch upstream into an isolated worktree;
2. review the complete diff in T3 threads or a council;
3. run repository checks;
4. push only after explicit GO.

Boundary

• never creates branches or pull requests;
• never merges or pushes code;
• has contents: read and issues: write only;
• has no issue_comment trigger;
• trusts only its own github-actions[bot] issue, preventing public marker spoofing;
• closing the managed issue dismisses only the current upstream revision.

No Allow GitHub Actions to create and approve pull requests setting is needed.

Validation

• vp check
• vp run typecheck
• actionlint .github/workflows/upstream-sync.yml
• embedded Bash and JavaScript syntax checks
• live comparison against public upstream: 5 commits pending
• independent blocker review: no blockers