chore: add recurring upstream sync review process

[marcorivm]

Why

This fork re-lands substantial local work (org RBAC, user groups, granular resource scoping, gateway condition matching, spend budgets) onto each upstream base, so "merge upstream" is never mechanical. Until now the review was rediscovered from scratch each time, with no record of what we'd already decided or skipped.

This adds a tracked anchor and the tooling to run the cycle repeatably.

What's here

• docs/upstream-sync/state.json — records the last upstream commit we reviewed. Each cycle reviews lastReviewedCommit..upstream/main and advances it. Anything decided but not yet merged lives in pendingAdoption so the next cycle doesn't re-litigate it.
• .agents/skills/upstream-sync/ — the process, invocable as /upstream-sync:
  • scan.sh computes the delta and measures conflicts by running a merge trial in a throwaway worktree, rather than guessing from a diff. Emits scan.json.
  • review-workflow.js fans out one reviewer per subsystem plus one per conflicted file, then synthesizes an adoption plan.
  • cleanup.sh tears the worktrees down.
  • All mutation happens in .claude/worktrees/ (gitignored). The primary working tree is never touched.
• docs/upstream-sync/reviews/ — per-cycle decision log, so later cycles can see what we already decided and why (especially the skips).

First review: v1.44.0 → v1.45.0

Included as docs/upstream-sync/reviews/2026-08-05-v1.45.0.md. Two commits, 80 files, 18 files touched by both sides, 6 real conflicts. 17 items decided — 9 take, 7 take-with-adaptation, 1 needs-decision.

This PR does not adopt any upstream code — it only records the review.

Two blockers found, both in files git merged with zero conflict markers, each verified directly against the merge tree:

1. Upstream's new fail-closed check silently disables our granular resource scoping. connect.rs:1375 bails unless a scoped token was minted or ee_apps::has_request_guard(provider) is true. Both are permanently false here — try_refresh_credentials returns None (stub, ee_apps.rs:12-18) and has_request_guard is hardcoded false (ee_apps.rs:36-38). Every resource-scoped GitHub/Dropbox connection would stop injecting any credential, with cargo test still green. Total silent regression of 5fa5509.
2. apps/web/src/lib/api/keys.ts merged clean and broken — two projects: keys in one object literal, so queryKeys.projects.detail becomes undefined.

The review also flags 5 open judgement calls, the sharpest being that upstream and this fork independently built incompatible models for "restrict a credential to specific repos" — they scope the credential, we guard the request. That's a fork-direction decision, not a merge decision.

Notes

• Targets open-edition/reconciled (not main), since the v1.45.0 adoption is being applied on that branch and the review belongs alongside it. Rebased onto 36aebad, so the diff is exactly the 8 new files.
• Both scan.sh paths tested — the delta path reproduces the review's numbers exactly (2 commits, 18 overlapping, 6 conflicts), and the up-to-date path short-circuits correctly now that state points at upstream HEAD.