Add a sync-upstream reusable workflow to keep a fork current with its upstream

[d-morrison]

Problem

Several d-morrison/UCD-SERG repos are forks of an external project (e.g. d-morrison/altdoc is a fork of etiennebacher/altdoc). Keeping the fork current with upstream is currently a manual chore: add the upstream remote, merge, resolve conflicts, open a PR by hand (see the d-morrison/altdoc#20 → #22 saga). There's no reusable automation for it.

The existing content-sync family (bump-submodule, sync-shared-fragments) covers vendored content between a pair of repos, but not the fork tracks its upstream case.

Proposal

Add a sync-upstream.yml workflow_call reusable workflow that:

• Fetches a configured upstream repo's branch (upstream-repo, upstream-branch inputs; optional UPSTREAM_TOKEN for private upstreams).
• Squash-merges upstream into the fork's working tree (git merge --squash, which stays out of a MERGE_HEAD state so the shared open-sync-pr composite's git switch -C works) — a real three-way merge, so the fork's own files are preserved and only upstream's changes since the last common commit are applied.
• Reuses open-sync-pr to commit the merge to a reused automation branch and open/update a single PR (a no-op when the merge brings nothing).
• On a clean merge → mergeable PR. On a conflict → by default commit the conflict markers so the drift surfaces as a visible PR for manual resolution; a fail-on-conflict input fails the run instead.

Ship the usual doc set: examples/sync-upstream.yml, website/reference/sync-upstream.qmd, README + workflows.qmd table rows, and a changelog fragment. New capability → pins @v2 (postdates the @v1 freeze).

Consumer

d-morrison/altdoc will adopt it to track etiennebacher/altdoc weekly.