feat: render patched upstream workflow templates

[vitormattos]

Summary

Add the patch-aware rendering layer on top of #4's automated upstream refresh.

The complete flow becomes:

tracked Nextcloud workflow
  -> resolve latest upstream commit
  -> immutable URL + SHA-256
  -> vendored upstream bytes
  -> ordered downstream patches
  -> generated workflow-templates/ artifact
  -> automated pull request

The renderer processes every declared workflow instead of stopping on the first broken patch.

GitHub-native template output

Generated workflows are published under workflow-templates/, matching GitHub's organization workflow template convention.

Template metadata (*.properties.json) is maintained by LibreCode so names, descriptions, categories and icons can be optimized for our developer experience without inheriting Nextcloud-specific branding. The first template uses a GitHub Octicon rather than copying Nextcloud's trademark SVG.

LibreCodeCoop/github-workflows remains the source of truth. A follow-up (#7) will publish these generated templates to the special LibreCodeCoop/.github repository so they appear in Actions → New workflow and validate the first end-to-end consumer.

Automated update behavior

When the scheduled refresh finds upstream changes it:

• updates the immutable upstream pins and vendored files;
• verifies the downloaded sources;
• applies all declared downstream patches;
• updates every template whose patches still apply;
• runs the test suite;
• opens one update pull request.

If every patch applies, the pull request is opened normally.

If one or more patches fail, the workflow still opens the update pull request as draft. Its body lists the affected template, patch path and patch error. The vendored upstream file is included, while the generated template for that failed patch remains at its previous known-good version. After the PR is created, the workflow fails so the problem is visible both in the PR and in Actions.

Failures while resolving/downloading/verifying upstream sources remain fatal and do not create partial update pull requests.

First adapted workflow

The first rendered template is Nextcloud's appstore-build-publish.yml.

The first shared patch only removes the upstream restriction to the nextcloud-releases organization. Other current LibreSign divergences are not copied into the shared contract without a separate justification.

This replaces the current silent-fork pattern with explicit, versioned and testable downstream adaptations.