Replace mise's upstream hook with a declarative GitHub-releases provider

After the quarantine moved into the manifest, all mise-bin's hook still knew
was data: the repository, the checksum manifest name, and the asset filename
patterns. That now lives in .omarchy/package.json as an upstream block --

  "upstream": {
    "github": "jdx/mise",
    "checksums": "SHASUMS256.txt",
    "assets": { "x86_64": "mise-{tag}-linux-x64.tar.xz", ... }
  }

-- handled by helpers/upstream-github.sh inside bin/sync-upstream. The
provider walks the release feed (drafts/prereleases excluded), honors
min_release_age and BYPASS_MIN_RELEASE_AGE during selection, reports
published_at so the framework backstop still applies, fails closed on any
unreadable tag or timestamp, and skips the checksum fetch when the newest
qualifying release is already checked in.

upstream.sh remains the escape hatch for feeds that fit no convention
(openai-codex-desktop's Debian index, tmog's version.txt, t3code's
electron-builder manifest); declaring both is an error.

helpers/package-metadata.sh

@@ -13,6 +13,7 @@
 #   { "source": "aur", "rebuild_on": ["qt6-base"] }
 #   { "source": "local" }
 #   { "source": "local", "min_release_age": "24h" }
+#   { "source": "local", "upstream": { "github": "owner/repo", "checksums": "SHASUMS256.txt", "assets": { "x86_64": "name-{tag}-x64.tar.xz" } } }
 #
 # bin/sync-aur also writes upstream_commit for AUR-backed packages, and
 # bin/sync-rebuilds writes rebuilt_against for packages declaring rebuild_on.
@@ -164,9 +165,14 @@ package_has_upstream_hook() {
   [[ -f "$pkgdir/.omarchy/upstream.sh" ]]
 }
 
+package_has_upstream_provider() {
+  local pkgdir="$1"
+  [[ -n "$(package_metadata_value "$pkgdir" '.upstream.github' "")" ]]
+}
+
 packages_for_upstream_sync() {
   package_dirs | while IFS= read -r pkgdir; do
-    if package_has_upstream_hook "$pkgdir"; then
+    if package_has_upstream_hook "$pkgdir" || package_has_upstream_provider "$pkgdir"; then
       basename "$pkgdir"
     fi
   done
@@ -340,6 +346,20 @@ validate_package_metadata() {
     return 1
   fi
 
+  if ! jq -e '
+    (.upstream // {}) | type == "object"
+    and (if . == {} then true else
+      ((.github // "") | type == "string" and test("\\A[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+\\z"))
+      and ((.checksums // "") | type == "string" and length > 0)
+      and ((.assets // {}) | type == "object" and length > 0 and (to_entries | all(
+        (.key | test("\\A[a-z0-9_]+\\z")) and (.value | type == "string" and length > 0)
+      )))
+    end)
+  ' "$metadata" >/dev/null; then
+    echo "invalid upstream for $(basename "$pkgdir"): needs github owner/repo, checksums asset name, and an assets arch->name map"
+    return 1
+  fi
+
   pkgrel_type=$(jq -r 'if has("pkgrel") then .pkgrel | type else "missing" end' "$metadata")
   case "$pkgrel_type" in
     object|missing) ;;