chore(pylon): harden fork synchronization

[rynfar]

Problem

The mirror workflow updates main with a direct Git push and carries an optional App-token path. That prevents us from locking the mirror branch without either weakening protections or exposing a credential that could trigger inherited upstream publication.

Fix

• update main through GitHub's fork merge-upstream API only after a readable, exact-main repository ruleset proves the workflow token cannot bypass the update, deletion, linear-history, and non-fast-forward rules;
• verify the registered Prime parent, API source/result, and exact post-sync SHA, with no direct-push or privileged-token fallback;
• make candidate branches deterministic and validate their parents, tree, and stored verification run before reuse;
• reuse CI only when the Actions API proves the candidate-bound build-check-test aggregate succeeded; otherwise rerun verification;
• keep manual PR handoff idempotent and preserve the exact draft title, body, label, branch, and CI evidence;
• document the zero-bypass ruleset and future-upstream-merge stop condition.

The workflow intentionally fails closed until the live repository ruleset is provisioned. After this lands, maintainers must enable squash merging as GitHub's linear-history prerequisite, create and audit the zero-bypass exact-main ruleset, remove the superseded classic main protection, and validate a real dispatch before calling the mirror locked.

Verification

• bash -n scripts/pylon-sync-upstream.sh
• shellcheck scripts/pylon-sync-upstream.sh
• actionlint .github/workflows/pylon-upstream-sync.yml
• git diff --check
• disposable fork tests for ruleset rejection, API fast-forward, deterministic candidate creation and reuse, stale issue recovery, successful CI reuse, and failed CI re-verification
• historical failed sync run rejected as reusable evidence
• npm run check via the signed commit hook
• two independent final reviews: no code blockers

Refs #1.

Implemented by GPT-5.6 in Prime Agent, orchestrated through Pylon.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}