feat(ci): add AI-powered upstream release analyzer with draft PR batching (#1)

Introduce a 3-pass analyzer pipeline that classifies every commit in an
upstream release window as GOOD / NEEDS_REVIEW / SLOP, then cherry-picks
each batch onto its own branch and opens one draft PR per non-empty
batch. All merges remain manual in Phase 1 - advisory only.

Pipeline:
  * Pass 1: per-commit classification via gpt-4.1-mini (low tier,
    150 req/day on Copilot Student)
  * Pass 2: slop verification of first-pass SLOP hits via gpt-5-mini
    with automatic fallback to gpt-4.1 then gpt-4.1-mini when the
    5-mini tier exhausts its 12 req/day quota or rejects on context
    length (4K cap)
  * Pass 3: release-level cost-benefit synthesis via gpt-4.1

Trigger:
  * upstream-tag-watcher.yml (cron */15) polls upstream ls-remote and
    fires repository_dispatch when a new stable tag appears, acting as
    a pseudo-webhook since we cannot subscribe to a repo we do not own
  * upstream-analyzer.yml handles the dispatch and also runs manually
    via workflow_dispatch for ad-hoc release analysis

Output:
  * One analysis issue with cost-benefit report, slop ratio, breaking
    change assessment, and action items
  * Up to 3 draft PRs (sync/upstream-<tag>-{good,needs-review,slop})
    each labeled upstream-sync + batch:<verdict> + upstream-tag:<tag>
  * All classification JSON artifacts uploaded per workflow run

Prompts live in .github/prompts/*.md and are loaded at runtime so tone
and rubric can be tuned without touching workflow YAML or TS code.

Disable the old sync-upstream.yml workflow:
  * Scheduled trigger removed - only manual dispatch behind a typed
    confirmation input remains (preserves history for reference)
  * Replace printf >> GITHUB_OUTPUT with brace-grouped redirect to
    silence shellcheck SC2129

Token budget on Copilot Student tier covers a ~50-commit release with
headroom; the fallback chain keeps the pipeline functional even when
gpt-5-mini's tight quota is exhausted.