fix: implement single-PR workflow for upstream sync conflict resolution

[mateo-di]

Description

Shortcut

• Autolink: [sc-521238]

Changes the upstream sync architecture to use a dedicated sync branch instead of creating PRs directly from main. This enables pushing conflict resolution commits directly to the existing PR.

Architecture Change

Before (2 PRs, confusing)

main → PR #1 to carto/main (conflicts!)
     └── Can't push to main
         └── PR #2: upstream-sync-resolver/XX → carto/main (separate)

After (1 PR, clean)

main → upstream-sync/vX.Y.Z (dedicated branch)
     └── PR to carto/main
         └── Conflicts? Push resolution to same branch (PR auto-updates)

Changes

File	Change
carto-upstream-sync.yml	Creates upstream-sync/vX.Y.Z branch from main before creating PR
carto-upstream-sync-resolver.yml	Pushes to existing sync branch instead of creating new PR

Benefits

• Single PR workflow - No separate resolution PR needed
• Cleaner git history - All sync work in one place
• Less confusion - Obvious which PR to merge
• Deterministic - Git operations hardcoded in workflow, not in Claude prompt

Type of change

• Fix

Acceptance

1. Close PR fix: resolve conflicts for upstream sync PR #41 #45 and 🔄 sync: upstream v1.79.3-stable #41 (created with old broken workflow)
2. Trigger upstream sync workflow manually or wait for Monday schedule
3. Verify single PR is created with upstream-sync/vX.Y.Z branch
4. If conflicts, verify resolver pushes to same PR (no new PR created)

Basic checklist

• Good PR name
• Shortcut link
• Just one issue per PR
• GitHub labels
• Proper status & reviewers
• Tests (N/A - workflow change)
• Documentation (self-documenting)