Add bin/sync-upstream for packages that track a vendor release feed

Some vendors publish a release feed of their own that is faster and more
precise than anyone's packaging of it. A package opts in with an
.omarchy/upstream.sh hook that reports the newest release as JSON, and the
driver rewrites pkgver, the checksum arrays the hook names, and pkgrel.

Writes are guarded on both ends: every assignment the update will touch is
verified to exist before anything is written, so a hook naming an array the
PKGBUILD lacks fails with the file untouched rather than half rewritten; and
pkgver is held to pacman's character set, because it lands in a file makepkg
sources as shell.

Ordering is vercmp's, not sort -V's -- they disagree about whether 1.0a
precedes 1.0, and pacman is what decides if a published package is an upgrade.
That is also why the workflow runs in an Arch container rather than straight on
the runner.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

helpers/package-metadata.sh

@@ -135,6 +135,19 @@ packages_for_aur_sync() {
   done
 }
 
+package_has_upstream_hook() {
+  local pkgdir="$1"
+  [[ -f "$pkgdir/.omarchy/upstream.sh" ]]
+}
+
+packages_for_upstream_sync() {
+  package_dirs | while IFS= read -r pkgdir; do
+    if package_has_upstream_hook "$pkgdir"; then
+      basename "$pkgdir"
+    fi
+  done
+}
+
 packages_for_mirror() {
   local mirror="$1"