refactor: replace push-based sync with pull-based reusable workflow

[NWarila]

Summary

• Remove sync-downstream.yml and its PAT requirement — sync is now pull-based
• Downstream repos call self-update.yml as a reusable workflow via uses: nwarila/python-template/.github/workflows/self-update.yml@v1
• Extract inline sync logic into scripts/sync.py (standalone, stdlib-only, testable)
• Add workflow_call trigger so the same workflow serves both dogfood and downstream
• Remove downstream_repos from sync-manifest.json (template doesn't push)
• Document manifest-driven sync rationale vs submodules/packages

Design

Each repo owns its own updates. The template publishes releases, consumers pull when ready. No cross-repo credentials, no push permissions, no coupling.

Downstream repos only need a thin wrapper:

name: Template Sync
on:
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:
permissions:
  contents: write
  pull-requests: write
jobs:
  sync:
    uses: nwarila/python-template/.github/workflows/self-update.yml@v1

Test plan

• scripts/sync.py runs against this repo as template source (15 files synced)
• Marker-preserve logic tested with template and repo-specific regions
• YAML syntax validated on self-update.yml
• Manifest structure validated (no downstream_repos, all mappings have src/dest)
• All three workflow triggers present: schedule, workflow_dispatch, workflow_call