refactor: simplify workflow catalog synchronization

[vitormattos]

Align the catalog synchronization implementation and documentation with the post-migration architecture.

• execute actions/sync-workflows from the catalog checkout already used as the template source, so templates, helper logic and recorded catalog_commit always come from the same revision;
• remove the retired github-workflows ownership statement from AGENTS.md;
• document the current GitHub App credential model for upstream refresh;
• document the intentional split between structural upstream refreshes and Dependabot-managed Action pins;
• remove the obsolete internal github-workflows-sync user-agent identifier.

This removes a redundant second version pin for the synchronization helper without changing the materialized-workflow model.