sync-upstreamlisted

Reconcile the forked skills with a new upstream release: disposition every upstream delta, gate every disposition on the user's approval, audit the whole divergence surface, and record the new sync point. Nothing enters the repository without an approval, and a case these rules do not cover is put to the user rather than improvised on. ## Step 1: Measure Get the exact new tag from `gh release list -R <upstream>`. Every measurement comes from `scripts/fork-diff.sh` (through `mise run dev:fork-diff -- …`); fetch nothing by hand. The tool reads each fork's `source:` frontmatter, re-prefixes its bare pinned version into the real tag, resolves the upstream skill's directory from the repository tree API rather than guessing it, fetches and caches the upstream files under `.scratch/sync/`, and prints a unified diff per file with a divergent-line count. Run it twice: - With no skill arguments, against the pins: every fork measured, whether or not upstream moved it. This is the audit — a release touching three files still gets all the forks measured, drift nobody has looked at being the audit's whole point. - With `--tag <new-tag>` and the updated upstream's forks named, since one tag cannot be right for both upstreams. Pass the tag exactly as the release lists it, prefix included: the tool uses the override verbatim, re-prefixing only the pinned `source:` version. A wrong tag prints `skipped: could not read the tree` per fork and exits zero: an all-skipped second run is a f