feat(upstream): add commit-level triage and weekly watch for forks (#305) (#320)

Forks tracking this template face a weekly "which of these commits do I
actually care about?" question. check_upstream_updates.py answers it at the
file level (version stamps); this adds the commit-level half.

tools/upstream_triage.py walks the commits a fork is behind and splits them
into "worth reviewing" and "probably skip". Work already ported drops off on
its own via git patch-id, commits touching only files the fork removed are set
aside, and SHAs in .github/upstream-wontport.txt stay hidden. It reports and
nothing more - ready-to-run cherry-pick lines, but no merge, push, or PR,
since on a fork "applies cleanly" is not "correct".

.github/workflows/upstream-watch.yml runs it weekly into one rolling issue. It
no-ops on the upstream template (guarded, and pinned by a test) and uses only
the built-in GITHUB_TOKEN, so it can never write outside its own fork. The two
tools point at each other in their output; README, SETUP 8, and CHANGELOG
introduce them together. Tests cover patch-id matching, relevance filtering,
the won't-port list, and the workflow guard - all offline.

Co-authored-by: Angelina Lok <angelina@chattermill.io>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

tools/check_upstream_updates.py

@@ -175,7 +175,6 @@ def main() -> int:
             print(f"    Diff command: git diff {ref} -- {up['path']}")
             print()
         print("Review these changes to see if they fit your personalized fork!")
-        return 0
     else:
         if errors or missing_upstream:
             print(
@@ -185,7 +184,13 @@ def main() -> int:
             )
         else:
             print(f"[OK] All framework files are up to date with {ref}!")
-        return 0
+    # Version stamps answer "which of my files changed"; commit-level triage
+    # answers "which upstream commits deserve review". Point at the companion.
+    print(
+        f"\nFor commit-level triage of upstream commits, run: "
+        f"python3 tools/upstream_triage.py --remote {remote}"
+    )
+    return 0
 
 if __name__ == "__main__":
     sys.exit(main())