feat(distribution): add pilot template sync automation

[kraus-it]

Slice 2/6: pilot satellite automation

Adds deterministic, allow-listed packaging and normal-commit synchronization for the React/Vite, Next.js, and Spring Boot pilot template repositories.

Included

• secret-safe package allow-lists and generated Apache-2.0 template assets
• repository bootstrap, sync, and remote drift verification tooling
• explicit managed-file markers; unmanaged files are preserved
• scheduled drift checks and manually gated sync workflow
• runnable, fail-closed React/Vite, Next.js, and Spring Boot samples
• pinned dependency locks and Gradle wrapper
• PKCE, session expiry handling, RP-initiated logout, and no raw token rendering

Verification

• cd distribution && npm ci && npm run validate (14 tests)
• cd auth_samples_react && npm ci && npm run lint && npm run build
• cd auth_samples_nextjs && npm ci && npm run build
• cd auth_samples_java && ./gradlew --no-daemon clean test bootJar
• bootstrap dry-run confirms all three targets are new repositories

The GitHub Claude workflow is also requested below; if its configured external reviewer quota is unavailable, this PR remains gated for a review retry.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

@claude Please review this Slice 2 change for security, deterministic packaging and sync safety, drift detection, CI safety, and OIDC correctness. Report concrete findings with severity and file/line.

[kraus-it]

Review gate note: @claude acknowledged the request but returned no findings. The repository Claude workflow completed successfully in its explicit "credential unavailable" path, and the local Claude reviewer is rate-limited until 02:20 Europe/Berlin. CI plus a manual security/correctness review found no remaining blocker; all listed builds and tests pass.