Add bounded bulk Mike synchronizer

[ranade-oss]

What changed

• adds a daily/manual bulk synchronizer for all new first-parent commits on Open-Legal-Products/mike;
• uses deterministic path, size, binary, deletion, rename, and commit-count gates before AI analysis;
• asks one read-only Codex job to adapt all eligible changes into one ROSS patch;
• validates the combined patch on a fresh runner with the complete npm run check engineering gate;
• requires a second independent read-only Codex review;
• publishes exactly one trusted agent/upstream-bulk-* PR from the already validated bytes;
• records skipped and deferred commits in a durable cursor and ledger;
• publishes a state-only deferred PR when the independent reviewer rejects automatic integration.

Safety boundaries

The automatic lane excludes workflows, dependencies, lockfiles, destructive changes, authentication, authorization, security, cryptography, secrets, permissions, legal/privacy/governance/release controls, schemas, migrations, databases, RLS, tenants, providers, connectors, storage, deployment, billing, telemetry, uploads/downloads, and architecture.

Mike content is explicitly treated as untrusted. Neither Codex job receives repository write credentials. The final publisher independently checks that main is still the exact validated base. Generated PRs must still pass exact-head Baseline before the existing merger can merge them.

Initial cursor

The cursor starts at Mike commit e89d3230db40193c540a6b38d8f301ae76377a1a, because changes through that point were already classified during ROSS PRs #32 and #34.

Verification

Baseline must validate actionlint, the new governance regression test, all repository tests/builds/audits, and the exact final head.