feat(ci): stage catalog sync and auto-fix with review skill

[Yimin-Jin]

Summary

• Keep one Sync Sample Catalog workflow and one job, with separate scan, metadata, grouping, Details, write, Draft PR, and final skill-review steps.
• Automatically apply bounded prose corrections: at most two repair passes and one fresh final verification; unresolved findings fail the workflow while preserving the Draft PR. No manual corrections are required on the successful path, and approval/merge remain human-controlled.
• Run pinned Copilot CLI 1.0.88 in a read-only, network-isolated container with only view/grep/glob/skill tools. The host retains GitHub/Azure credentials and exposes only a bounded inference proxy.
• Validate field scope, pinned-source quotations, catalog invariants, and trusted tests before appending a commit parented to the captured PR head with a non-force ref update. Refuse reruns that would overwrite an existing run branch.
• Use the same review-sample-catalog skill for CI and maintainer review. The catalog snapshot itself is unchanged.

Validation

• Local Node regression suite: 123/123 passing.
• Workflow YAML, single-job ordering, skill links, syntax/diagnostics, and git diff checks passed.
• Offline Docker/CLI smoke test is wired into the existing validation step; GitHub runner verification is in progress because the local Docker daemon is unavailable.
• A live Azure model review and automatic data-PR publication have not yet been verified end to end.

Guardrails

• No agent shell, edits, GitHub tools, source execution, or raw write credentials.
• Maximum three agent passes, 40 model requests and 300k reported tokens per pass, 16k output tokens/request, 12 minutes/pass.
• Only affected card prose and new template name/description may change; existing identities, membership, Patterns and unaffected metadata/Details are protected.
• Evidence-reference validation is deterministic, but semantic judgment remains model-based; blocked reports must never be treated as approval.