Add bulk upstream Mike synchronizer

[ranade-oss]

What changed

• adds a daily and manually dispatchable bulk synchronizer for merged Open-Legal-Products/mike PRs;
• reviews up to 20 merged upstream PRs per batch and records every classification in a durable cursor/ledger;
• combines all mechanically permitted low-risk Adopt/Adapt changes into one ROSS PR;
• records protected, uncertain, architecture-dependent, or oversized changes as Investigate without applying them;
• records irrelevant, already implemented, superseded, or non-portable changes as Skip;
• allows only provenance-marked github-actions[bot] PRs on agent/upstream-sync-* branches into the existing exact-head dispatcher and merger.

Safety boundaries

Automatic patches are limited to documentation, repository hygiene, frontend presentation markup, and tests. The clean runner rejects .github, backend runtime, scripts, manifests, dependencies, lockfiles, auth/security/provider, schema/migration/Supabase, deployment/infrastructure, legal/privacy/governance/release/billing, environment, deletion, binary, rename, and oversized changes.

The existing Baseline, failed-run reporting, exact-head checks, reviews, unresolved-thread checks, and mergeability gate remain authoritative.

Batch behaviour

• maximum 20 upstream PRs per run;
• maximum 20 changed ROSS files and 2,000 changed lines in the combined patch;
• one synchronization PR per successful batch;
• 500-entry durable classification ledger;
• no repeated processing after the cursor advances.

Current limitation

Bot-authored synchronization PRs automatically verify and merge when green. A failed synchronization PR is reported but is not yet eligible for bounded Codex repair; that bot-specific repair exception will be added only after this intake and provenance path is validated end to end.