Add sync-d1 workflow: issue edits reconcile the catalog into D1

.github/workflows/sync-d1.yml

@@ -0,0 +1,36 @@
+name: Sync D1 Catalog
+
+# GitHub issues own the SRS catalog (topics, problems, set/diff labels,
+# milestones); the Worker's D1 holds a reconciled copy. The 8 AM ET cron is
+# the backstop — this workflow pushes curriculum edits into D1 immediately.
+#
+# The reconcile is a total recompute (never touches SRS-owned columns), so
+# bursts can safely collapse to the last run: cancel-in-progress is correct.
+
+on:
+  issues:
+    types:
+      [opened, edited, labeled, unlabeled, milestoned, demilestoned, reopened, transferred, deleted]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: sync-d1
+  cancel-in-progress: true
+
+jobs:
+  reconcile:
+    # Only curriculum issues shape the catalog.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      contains(github.event.issue.labels.*.name, 'problem') ||
+      contains(github.event.issue.labels.*.name, 'topic')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reconcile catalog into D1
+        run: |
+          curl -sf -X POST -H "Authorization: Bearer $SRS_ADMIN_KEY" \
+            https://srs-api.prdlk.workers.dev/admin/reconcile
+        env:
+          SRS_ADMIN_KEY: ${{ secrets.SRS_ADMIN_KEY }}