ci(sync): add upstream auto-sync workflow

Tracks upstream tags via `git ls-remote --tags --refs upstream 'v*'`
instead of local tag storage, which would otherwise commingle upstream
tags with this fork's own publish tags and create a feedback loop
where every sync cycle triggers a fresh publish cycle.

Key properties:
- Queries upstream tags directly via ls-remote (never consults local
  tag storage; blind to the fork's own publish tags on origin)
- Fetches only the specific tag's commit via refs/tags/$TAG with
  --no-tags, so no local tag is created
- Rebases onto the tagged commit (not upstream/dev HEAD) so we only
  sync to stable upstream releases, not post-tag WIP
- Separates head_moved (real code change) from tracker_updated
  (metadata-only change); publish is only dispatched when head_moved,
  preventing tracker-correction runs from cutting empty releases
- Concurrency group 'sync-upstream' prevents overlapping runs between
  scheduled cron and manual dispatch

Seed upstream-version.txt with v3.17.0 matching the current upstream
latest so the first post-deploy run is a clean no-op.