fix: protect workflow synchronization from local divergence

[vitormattos]

Reopens and completes #52.

Summary

Harden the reusable workflow sync Action before migrating more consumers.

The Action now:

• adopts an existing workflow only when it already matches catalog + local patch;
• refuses initial adoption when local content differs and no matching patch explains the difference;
• detects divergence when the lock already points to the current catalog version;
• reports a managed workflow that disappeared locally instead of silently forgetting it;
• keeps patch failures distinct from unmanaged local divergence;
• never overwrites an unmanaged divergent workflow during adoption.

This makes the migration safe for repositories such as LibreSign that already have many workflows with local history.