feat: add reusable workflow sync action

[vitormattos]

Closes #52

Summary

Move consumer-side workflow synchronization out of the large inline shell block and into a reusable, testable Action.

The Action:

• updates only workflow files already installed in the consumer;
• compares catalog versions using .github/actions-lock.txt;
• copies changed materialized workflows;
• applies consumer-local .github/workflows/<workflow>.patch files;
• keeps the lock tied to the catalog version before local patching;
• reports patch failures so the caller can open a draft PR;
• exposes deterministic outputs for the orchestration workflow.

The organization sync template now keeps only GitHub orchestration: authentication, checkouts, Action invocation and PR creation.

The central template also stops carrying Nextcloud-specific stable branches; consumers can add their own maintained branches through a local patch.