fix(ci): verify upstream sync candidates

[rynfar]

Problem

The first protected fork synchronization created the correct deterministic candidate, but its reusable CI inherited the caller's workflow_dispatch event. The trust job therefore returned false, every build/test/aggregate job skipped, and the outer sync run still concluded successfully.

Fix

• recognize internal candidate verification only for pylon-code/prime-agent, refs/heads/pylon, a scheduled or manually dispatched caller, and an exact lowercase 40-hex checkout SHA;
• preserve normal trusted pylon pushes and the existing PR label/vouch paths;
• add a require_trusted reusable-workflow input so the candidate aggregate runs and fails when trust, build, or tests were skipped or failed;
• require that fail-closed mode from the upstream sync caller.

After this lands, rerunning the deterministic candidate will retain commit 4591e8acfb2adf5552c90edbf5f1373e192290b0, reject its earlier skipped verification as reusable evidence, and execute real candidate CI.

Verification

• actionlint .github/workflows/ci.yml .github/workflows/pylon-upstream-sync.yml
• Ruby YAML parse for both workflows
• git diff --check
• trust-context matrix covering protected push, scheduled/manual exact-SHA calls, wrong repo/ref/event, malformed SHA, and push overrides
• npm run check via the signed commit hook
• independent security and workflow-semantics reviews: no blockers

Refs #8 and #1.

Implemented by GPT-5.6 in Prime Agent, orchestrated through Pylon.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}