feat(‎repo_policy_sync): add policy-driven GitHub workflow reference updates

[AlexanderLanin]

Why

This proof-of-concept adds policy-driven updates for GitHub workflow references so the project can evaluate the approach and compare its behavior and operational trade-offs with Renovate before deciding on a production direction.

What changed

• Add ensure_exact and ensure_minimal policy operations for external GitHub workflow targets.
• Support action subpaths and external reusable-workflow targets in .github/workflows/**/*.yml and .yaml.
• Resolve minimum releases and commit ancestry through authenticated gh api calls with run-scoped caching.
• Preserve workflow formatting, quoting, comments, and line endings during updates.
• Add a bundled policy requiring actions/checkout v6 or newer.
• Document the policy format, operation behavior, and architecture.

This remains a POC for further evaluation. Local targets and non-line-oriented YAML forms are intentionally outside the current scope.