feat: automate consumer workflow synchronization

[vitormattos]

Summary

Implement #13 with a central, safe workflow synchronization model for consumer repositories.

Design

Consumer repositories opt in through consumers.json.

The central workflow:

1. builds a consumer matrix;
2. checks out the source templates;
3. checks out each consumer;
4. runs the tested synchronizer;
5. opens a reviewable PR in that consumer when managed files change.

No synchronization logic is duplicated into consumer repositories.

Safety model

Managed workflows use .github/librecode-workflows.lock with SHA-256 hashes.

A workflow is updated only when its current content still matches the previously recorded lock. If a developer changed a managed workflow locally, synchronization fails instead of overwriting that divergence.

Initial adoption is also conservative:

• if the existing workflow already matches the LibreCode template, it is adopted and locked;
• if it differs, adoption fails and requires explicit review.

First consumer

LibreCodeCoop/extract is declared with reuse.yml, which has already been manually validated in #7.

After this PR lands, the first automated run should create an adoption PR containing only the management lock because extract/.github/workflows/reuse.yml already matches the current template.