fix(ci): repair fork-owned marker guardrail and dedupe sync catch-all

[arrrrny]

Related Issue

Follow-up to #75 / #76.

Problem

Two defects in the sync workflow's failure reporting:

1. The guardrail parser is not portable. .github/FORK_OWNED_FILES pads entries as path<spaces>::<space>marker. The guardrail parsed the path with sed -e 's/[[:space:]]\+::.*$//' — GNU's BRE \+ one-or-more extension. That is correct on ubuntu-latest, where the guardrail has been passing (prior clean syncs pushed by github-actions[bot] required it to pass). It only misparses under BSD sed, where \+ is not a BRE quantifier, so the list can't be verified locally on macOS.
2. The catch-all issue double-reports a conflict abort. It runs on plain failure(), so it fires alongside the dedicated conflict issue whenever the "Fail job on conflict" step exits non-zero — exactly how sync: upstream sync failed (2026-09-12) #76 was created for the same run as sync: upstream merge conflicts require manual resolution #75.

What changed

• Guardrail parser: use the POSIX-portable [[:space:]]*:: (works under both GNU and BSD sed) and trim trailing whitespace from the marker; treat an entry that parses to an empty path or marker as malformed instead of silently passing (an empty marker made grep -F match anything).
• Catch-all condition: failure() && steps.merge.outputs.merge_state != 'conflicts' && steps.verify.outputs.guard_state != 'fail'. It stays quiet when the conflict or guardrail path already opened its own issue, and still fires for genuine unexpected failures (push rejection, etc.).

Verification

• Ran the updated guardrail step against the current .github/FORK_OWNED_FILES: 31 entries, 0 missing, 0 marker-missing; on the working tree with in-progress additions, 33 entries, 0/0.
• Multi-word markers survive (e.g. Fuck Permissions Mode).
• The workflow still parses as valid YAML; both step conditions were checked.

Correction

An earlier version of this description claimed the guardrail was broken on CI and would fail the next clean sync. That was wrong. The committed line used GNU BRE \+, which correctly matches the padded run on the ubuntu runner; the failure I reproduced came from transcribing the pattern as [[:space:]]:: (dropping \+) and testing that instead. Prior clean syncs pushed by the workflow confirm the guardrail passed on CI. The change stands as a portability improvement — it lets the list be verified locally — not as a CI fix.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset. (CI workflow only — not user-perceivable.)
• Ran gen-docs skill, or this PR needs no doc update.

[github-actions]

❌ Nix build failed

Hash mismatch in pnpmDeps:

	Hash
specified	sha256-rKG18o/SNptyamq3LKveIEN/1LA0myX0JK/o6+yQ5Js=
got	sha256-4jpewFz0cw4nrv9dAwX3Q0VVgBC4HHZUxp+J8ARHrlQ=

Please update flake.nix with the got hash.