Add reusable vendored-file sync workflow

[Copilot]

Repos that vendor shared files currently surface drift as hard lint failures, leaving maintainers to manually run repo-specific refresh scripts. This adds a reusable workflow that separates PR validation from scheduled/manual auto-remediation via maintenance PRs.

• Reusable workflow

  • Adds .github/workflows/vendored-file-sync.yml.
  • Runs a caller-provided refresh-command.
  • Watches configured newline-delimited paths for resulting diffs.
  • Supports two modes:
    • create-pr: true opens or updates a maintenance PR via actions/open-pr.
    • create-pr: false fails validation when vendored drift is introduced directly.

• Caller configuration

  • Exposes inputs for branch, base, PR title/body, labels, commit message, draft mode, and signoff.
  • Exposes changed, pr-number, and pr-url outputs.

• Documentation

  • Updates docs/architecture.md with the validation/remediation split.
  • Adds an example using the same refresher command for both PR lint and scheduled/manual maintenance.

Example caller pattern:

jobs:
  validate:
    if: github.event_name == 'pull_request'
    uses: DevSecNinja/.github/.github/workflows/vendored-file-sync.yml@<sha>
    permissions:
      contents: read
    with:
      refresh-command: bash scripts/update-log-sh.sh
      paths: scripts/lib/
      create-pr: false

  sync:
    if: github.event_name != 'pull_request'
    uses: DevSecNinja/.github/.github/workflows/vendored-file-sync.yml@<sha>
    permissions:
      contents: write
      pull-requests: write
    with:
      refresh-command: bash scripts/update-log-sh.sh
      paths: scripts/lib/
      branch: chore/sync-vendored-log-sh
      pr-title: 'chore: sync vendored log.sh'
      labels: |
        automated
        vendored-file-sync

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• plugins.dprint.dev
  • Triggering command: /home/REDACTED/.npm/_npx/d897e534e3b3f845/node_modules/.bin/dprint dprint check --config config-sync/files/dprint.json docs/architecture.md (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)