test: harden workflow update failure recovery

[vitormattos]

Summary

Advance #14 by making the failure paths explicit and testable.

Changes

• fail early with a clear diagnostic when WORKFLOW_UPDATE_TOKEN is missing;
• verify a broken downstream patch preserves the previous known-good generated template;
• verify invalid catalog source metadata cannot partially modify the published catalog;
• retain the existing consumer divergence protection tests.

Production finding

The first real post-merge executions of both:

• Publish workflow catalog
• Sync consumer workflows

failed at cross-repository checkout because WORKFLOW_UPDATE_TOKEN is not configured.

That operational dependency is now tracked separately in #20.

This PR does not weaken the credential requirement or fall back to the repository GITHUB_TOKEN, because that token is not intended to write across repositories.