decide: who watches upstream releases, and how often #184

Parent: #158. Split out of #163 so the policy could land without this blocking it.

#163 settled four of its five required decisions: mechanism, review checklist, attribution, and what we never take. docs/UPSTREAM.md carries them.

It deliberately did not settle cadence, and said so in the document:

Not settled by this document. Who reads upstream releases, and how often, is an owner and team decision. Until it is decided, upstream is read on demand — when someone wants a specific fix, or when a release note happens to mention something that matters to us.

Why this needs a decision rather than staying open

The adversarial review of #163 pushed back on leaving it open, and the pushback is fair: a policy's job is to create accountability where there was none, and declaring the status quo as policy guarantees the failure it warns about.

What "on demand" costs, stated plainly: an upstream security fix or crash fix can sit unnoticed until it bites us. Upstream runs about 88 commits per 30 days against 4 releases [api: repos/Kpa-clawbot/CoreScope, 2026-10-07], so there is a steady stream to not be watching.

The counter-argument, which is also real: a named obligation nobody performs is worse than an honest gap. The imported agent surface sat untouched for four months while appearing maintained (#144).

What has to be decided

1. Who reads upstream releases. A person, not "the team".
2. How often. A minimum frequency, not "regularly".
3. Where the "worth taking" decision is recorded when the answer is no. task: how we track upstream after the fork link is gone #163's policy says a rejected change gets one line on an issue; this should confirm that is the mechanism, or replace it.

A reasonable shape to argue with, not a recommendation: whoever is doing CoreScope work that month checks gh release list -R Kpa-clawbot/CoreScope when they start, which is cheap and self-scheduling, with an explicit accepted risk that quiet months go unwatched.

Not in scope

The mechanism for taking a change is already decided and documented. This issue is only who looks, and how often.

Done when

docs/UPSTREAM.md's "Cadence and ownership" section names a person and a minimum frequency, replacing the "not settled" text, and the owner has agreed to both.

Refs #163, #158