feat: automate workflow catalog publication

[vitormattos]

Summary

Implement #12 by making LibreCodeCoop/github-workflows publish its generated organization workflow templates to LibreCodeCoop/.github through a reviewable pull request.

Design

The workflow remains orchestration-only:

1. checkout this repository;
2. checkout LibreCodeCoop/.github into a separate working directory;
3. run the tested catalog synchronizer;
4. open/update a pull request in the catalog repository.

All synchronization rules live in scripts/sync_catalog.py.

Synchronization behavior

The synchronizer:

• publishes only *.yml, *.yaml, *.properties.json and optional custom *.svg catalog artifacts;
• requires every workflow template to have matching metadata;
• validates custom SVG icon references;
• updates changed catalog files;
• removes stale managed catalog files;
• preserves unrelated files in LibreCodeCoop/.github;
• supports a deterministic check mode;
• has unit coverage for additions, updates, removals, drift and invalid metadata.

The workflow uses the existing WORKFLOW_UPDATE_TOKEN; that token must have write access to LibreCodeCoop/.github.

Result

After this lands, changes under workflow-templates/ no longer require a manual copy into the organization catalog.