ci(cla): auto-record portal signatures + label server-side

[ajianaz]

What

• New .github/workflows/cla-sync.yml: listens for [CLA] Signature issues from the signing portal (https://codecoradev.github.io/cla/), validates them (issue opener must equal the claimed GitHub user — matches the portal's OAuth auto-fill; CLA type must be individual/corporate), appends the entry to .cla/signatures.json (idempotent on re-sign), applies the cla-signature label server-side, opens an auto-generated PR for owner approval, comments on the issue, and closes it.
• cla-check.yml: bot comment now instructs contributors to wait for the green submit confirmation before closing the tab.
• Requires new secret OWNER_PAT (classic PAT, public_repo scope is sufficient for this public repo) — org default workflow permission is read, so ${{ secrets.GITHUB_TOKEN }} cannot push or apply labels.

Why

• Portal submissions were broken end-to-end: (1) the portal's issue POST included a label the contributor token cannot create → 403 (see fix(cla): create signature issue without labels codecoradev.github.io#2); (2) even when an issue landed, signatures.json was only ever updated by manual owner commits. cla-sync closes both gaps so a contributor's only action is signing.

Testing

• Validation logic reviewed against the exact issue body template the portal generates (field regexes match - **Name:** etc.)
• Identity guard: issue opener != claimed user → rejected with explanation
• Idempotency: re-signing replaces the existing entry for the same username
• Label now pre-exists on this repo (created via API, green #0E8A16) and is re-applied server-side by cla-sync
• End-to-end live test pending merge (fire a test issue after OWNER_PAT is set)