ci: switch sync-fork to Dependabot-style handoff (no self-approval)

[niStee]

What

Switches the sync-fork workflow from 'attempt auto-approval + auto-merge' to 'open PR + post comment + wait for human'.

Why

GitHub blocks any identity from approving its own PR (HTTP 422 'Review Can not approve your own pull request'). The previous workflows tried to:

1. Have the App token both create AND approve the PR → fails on self-approval
2. Add the App to bypass_actors → bypass_actors only bypasses the 'require N approvals' rule, not the self-approval API restriction

The bypass_actors update has been reverted; the App is no longer in the bypass list.

Flow now (Dependabot-style)

1. App token opens the sync PR (different identity from the reviewer)
2. Workflow posts a comment tagging @niStee asking for review
3. You click Approve (you're the user, not the App, so approval works)
4. CI passes (if any), then you click Merge

This is the same pattern Dependabot uses: the bot opens the PR, a human approves and merges.

Security

No new credentials needed. The .pem in the repo secret is the GitHub App's private key — that's the standard pattern documented at https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow. The App's permissions are scoped to only the repos where it's installed, and the token it mints is short-lived (max 1 hour).