ci: add GitHub project reconciliation workflow

[ss-o]

Summary

• make GitHub Project 28 the canonical organization-wide tracker in the project runbook
• add a scheduled and manually dispatched read-only reconciliation workflow
• support explicitly requested project-membership application using a project-scoped token
• emit reconciliation artifacts for missing issues and project drift review

Verification

• YAML parsing passed
• scripts/validate-agent-policy.py passed
• git diff --check passed
• actionlint was unavailable in the local environment

Safety

The workflow is read-only unless manually dispatched with apply=true. It does not change issue state, labels, project fields, repository settings, or organization settings.