feat: adopt weekly template-sync with the tenant-template ownership model

[devantler]

🤖 Generated by the Daily AI Engineer

Why

Repos created from this template never receive template improvements — this week's portfolio-wide CI fixes reached instances only by hand-backporting. The tenant template already solved this with a proven sync + ownership model.

What

Adopts the weekly template-sync workflow (skipped in this repo, opens a sync PR in instances) plus a default .templatesyncignore encoding the three settled ownership classes — template-owned plumbing, instance-owned code/identity, scaffold-time-only machinery — documented in the README. One deliberate deviation from the tenant template: ci.yaml stays template-owned here, since every Go instance shares the same required-checks aggregation.

Fixes #176. The .NET twin (devantler-tech/dotnet-template#291) ports this once proven.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 17139005ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b8743f00a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: ef5131fc6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness record for head ef5131f (self-promotion):

1. Programmatically tested — full CI green at head (required aggregate + CodeQL + zizmor + Validate Scaffold); actionlint + zizmor clean locally on the new workflow; pentad clear (0 threads, CLEAN, codex lane).
2. Reviewed — Codex clean pass at exactly this head (Reviewed commit: ef5131fc6b), after two findings rounds (4 findings fixed: credential-less-instance guard, pkg/ wholesale protection, .golangci.yml instance-owned, header-comment consistency).
3. Tried as a user — this change has no exercisable runtime surface in the template repo itself: the sync job is deliberately if-guarded off here and enacts only in instances. Nearest observation: the enacting path (devantler-tech/actions template-sync reusable workflow consuming .templatesyncignore) is the identical, live-proven config running in gitops-tenant-template's instances, which delivered three plumbing updates this month (Template-sync for instances — shared plumbing only, tenant-template ownership model #176's evidence); the workflow parses clean and the if-guard was verified by this PR's own CI (job skipped in-template as designed). First real instance run is observable after merge on any go-template instance's Monday schedule.

Promoting and merging per the merge policy.