feat(distribution): automate satellite sync and drift checks

[kraus-it]

Summary

• synchronize only satellites affected by a merged source change, with a manual full-catalog option
• replace global-commit drift coupling with deterministic package checksums while retaining immutable source commit provenance
• verify all 20 repositories nightly and report actionable failures without force-pushing
• refuse unmanaged-file collisions and document operations/contribution policy

Verification

• npm --prefix distribution run validate (21 tests, 20 ready templates)
• docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.7
• actual Git diff selection: Astro-only lockfile change selects only astro
• manual full-catalog selection returns all 20 templates

Stack

• base: feat(templates): add final six auth starters #18
• keep this PR open until the stacked distribution epic is complete

[kraus-it]

Slice 5 remote verification completed:

• full catalog dry-run: 20 pending, 0 applied
• guarded synchronization: 20/20 repositories updated through normal commits
• post-sync verification: 20/20 repositories valid, 0 drift errors
• marker source commit: 6833b4a83ac9aaa09f289f5de9d02aa1fa053e7d
• local catalog suite: 21 tests pass
• workflows: actionlint 1.7.7 passes

@claude Please review this stacked PR, with special attention to workflow permissions, affected-template selection, marker semantics, and preservation of unmanaged satellite files.

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

@claude Please review the current head of this PR. Focus on correctness, security, distribution/sync behavior, reproducibility, and tests. Report only actionable findings; if clean, state that explicitly.

[kraus-it]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

Review follow-up complete on current head 2062bc3.\n\nLocal Claude review findings were fixed in cf62d31: workflow_dispatch no longer produces an empty base revision, event-derived expressions are normalized through environment inputs, affected-template selection is order-independent, and malformed sourceSha values are rejected by tests. Slice 3 and Slice 4 review fixes have also been merged through this stacked branch.\n\nVerification: actionlint passes and the current stacked catalog suite passes. The PR remains open and draft as requested.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.