feat: generate protected repository sync PRs

[xnoto]

Summary

• add centrally owned OpenTofu caller templates for standard, GCP, and libvirt roots
• add a repository-sync workflow that opens or updates downstream PRs for managed workflow and GPLv3 license files
• use the installed GitHub App with explicitly scoped Contents, Pull requests, and Workflows permissions

Security and delivery

• the workflow is OIDC-restricted to the repository-sync AWS role and reads one existing App key
• it creates only per-repository automation/repository-sync branches and pull requests
• it never writes protected default branches and never merges target PRs
• tfroot-namecheap is excluded because it has no default branch

Dependency

Requires tfroot-aws#24 to merge and apply the github-actions-repository-sync role before this workflow runs on main.

Validation

• reviewed the generated workflow and templates for credentials and sensitive data
• CI will validate the OpenTofu root; target-repository CI validates generated PRs after the workflow is enabled.

[github-actions]

OpenTofu CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan