ci: add fork/upstream sync guard workflow

[svelderrainruiz]

Summary

• add scheduled + manual ork-upstream-sync-guard workflow
• enforce deterministic parity checks for:
  • main head SHA
  • latest release tag
  • win/linux CLI asset digests
• emit machine-readable ork-upstream-sync-drift-report.json artifact and fail on drift
• add CI contract coverage for new workflow/script and wire into CI test list

Validation

• Invoke-Pester -Path ./tests -CI (20/20 passed)

Notes

• drift report schema is intentionally stable for machine consumption (schema_version: 1.0).