vendored-sync now couples every PR to CultureMech's availability

[realmarcin]

Follow-up from the review of #196, which removed the paths: filter from vendored-sync so it runs on every PR.

That was the right call for coverage — the guard previously fired for 1 of the 6 files it protects (#184) — but it changes the blast radius. Before, a failure to reach the hub broke only PRs touching vendored files. Now it can break every PR.

scripts/check_vendored_sync.sh fetches each file from:

https://raw.githubusercontent.com/CultureBotAI/CultureMech/<pinned-ref>/<path>

Six unauthenticated fetches per run. That request fails, and every PR in the repo goes red, if any of these happen:

• CultureMech is made private. The fetch is tokenless, so it would 404 — the same failure that blocked the claw repoint plan (see NEXT_TASKS.md section 2).
• The pinned commit is garbage-collected, e.g. after a force-push or branch deletion in the hub. scripts/.vendored_canon_ref currently pins 6be694f3d6308ac0f4c2e0dcf196e2ff73f6468f; nothing guarantees that object stays reachable.
• raw.githubusercontent.com has an outage longer than the retry window.

#196 added 3 attempts with a 5s gap, which covers a transient blip and nothing more. A sustained outage or a deleted ref fails hard, and the error is a diff/fetch failure on an unrelated PR — confusing to attribute.

Worth deciding

The tension is real: a guard that cannot run is not a guard, so degrading to "skip when unreachable" is exactly the failure mode that let vendored-sync pass while verifying nothing (#182) and that #181's local-checkout variant introduced. Do not simply skip on fetch failure.

Better options:

1. Distinguish "files differ" from "hub unreachable" in the exit status, and treat only the former as blocking. An unreachable hub becomes a loud warning annotation plus a non-blocking outcome, so it cannot be mistaken for a passing comparison. Still not silent.
2. Vendor a checksum manifest from the hub alongside the files so the common case needs no network, with the full fetch reserved for when the manifest changes. Careful: this must not become a self-referential pin — the manifest has to originate in the hub, which is what Re-converge drift check on CultureMech hub; extend to mech_shared; retire schema-pin #182 deleted the sha256 pins for.
3. Accept the coupling and rely on the nightly vendored-fleet-audit as the durable check, treating PR-time failures as noise to be re-run. Cheapest, and defensible given the guard is 7s.

Not urgent

CultureMech is public and the ref is on main's history, so nothing is failing today. Filing so the coupling is a recorded decision rather than an accident of #196.