ci: restore materialized workflow synchronization

[vitormattos]

Summary

Restore the Nextcloud-style workflow distribution model for the Extract validation path while keeping LibreCode patches as small as possible.

The rule for these downstream patches is: preserve the Nextcloud workflow verbatim unless a change is required for LibreCode infrastructure or for a specific consumer.

This PR:

• tracks Nextcloud's sync-workflow-templates.yml as an immutable upstream source;
• renders a LibreCode-patched synchronization workflow;
• publishes a full, materialized lint-eslint.yml instead of a reusable-workflow caller;
• limits the ESLint patch to LibreCode catalog provenance plus replacement of Nextcloud-only ubuntu-latest-low runners;
• limits the sync-workflow patch to LibreCode catalog provenance, LibreCode GitHub App authentication, and LibreCode repository/bot references;
• keeps consumer-specific differences such as supported stable branches out of the organization-level patch; those belong in the consumer's local .github/workflows/<workflow>.patch;
• removes LibreCodeCoop/extract from the old central push-based consumer list so Extract can validate the pull-based updater itself.

Expected flow:

nextcloud/.github -> immutable vendor source -> minimal LibreCode patch -> github-workflows/workflow-templates -> LibreCodeCoop/.github -> consumer sync-workflow-templates.yml -> reviewable consumer PR

The first end-to-end consumer validation will be done in LibreCodeCoop/extract, with any Extract-specific branch adaptations kept local to that repository.