Round 34: factory + public-repo alignment + first DB tests

[AceHack]

Summary

• tools/setup/common/sync-upstreams.sh — SQLSharp-shape sync script (ls-remote before destructive fetch; shallow clones; aggressive post-fetch reset+clean). 85 upstreams now live.
• CTFP moved to upstream — deleted 2,100 lines of vendored ctfp-dotnet/ + 16MB ctfp-milewski.pdf; docs/category-theory/ shrunk 16M → 4K. Both repos added to references/reference-sources.json; README rewritten to point at them.
• JDK + Bun migrate to mise — java = "26" and bun = "1.3" added; openjdk@21 removed from brew.txt. On Aaron's Mac: brew openjdk uninstalled; stale ~/.tool-versions dotnet pin cleared; profiles auto-sourced.
• Four new DEBT entries: cross-platform sync script, .txt manifest extensions, scratch-richness script organisation, thin shell-profile management.

Aaron's round-34 direction (post-merge): mise stays primary even when individual tools want older language versions — install multiple versions, override per-test rather than downgrading the default.

Test plan

• dotnet build -c Release — 0 warn 0 err
• dotnet test — 510 passed / 1 skipped
• shellcheck / actionlint / markdownlint / semgrep — 0 findings
• install.sh idempotent on Aaron's Mac (first run + second-run no-op)
• doctor.sh — 11 ok / 0 warn / 0 fail
• Branch protection gate on main (first PR to test it)

🤖 Generated with Claude Code