Replace sync-project.sh with a reusable declarative Projects v2 sync Action

## Summary

Replace `scripts/sync-project.sh` with a reusable GitHub Action
(TypeScript) that mirrors issues/PRs onto a Projects v2 board from a
declarative in/out spec. Board *schema* (fields, single-select options)
moves to the Terraform provider once it ships `github_project_v2` —
split to #253 (blocked on upstream), out of scope here.

## Motivation

Original scope was one tool owning both board *schema* (fields,
single-select option convergence) and *item sync*. Two things reshape it:

- **Schema belongs in Terraform, not a bespoke tool.** The provider's
Projects v2 gap (integrations/terraform-provider-github#1681) was
SDK-gated, not a design rejection — the umbrella request is still
open, go-github v88 groundwork landed in provider v6.13.0, and a
maintainer stated v7 will manage V2 Projects. When it ships, modeling
the Inbox project + fields in `terraform/alunduil/` beats maintaining
a custom field-type convergence engine. That removes the type-heavy
half that justified a heavier tool.
- **Sync can't be Terraform, ever.** Mirroring a dynamic, search-derived
set of issues/PRs hourly is a reconciling controller, not declared
config. It stays a tool/Action regardless of provider progress.

With schema gone, what remains is small, dynamic, and string-keyed
(resolve field/option IDs by name at runtime; list once; mutate only
new/drifted). A TypeScript GitHub Action is the idiomatic, lowest-
ceremony shape: runs natively on the runner (no container, no binary
fetch), uses first-party `@octokit/graphql`, publishes to the
Marketplace, and is reusable across the three owners already in
`sources` (alunduil / dungeon-studio / qua-world) — which an in-repo
script isn't. Lives in its own repo.

## Scope

- New repo: reusable TS action implementing sync (Marketplace-published,
versioned tags).
- Declarative per-board spec — sources (in) + field mappings (out);
evolve the sync half of `github/projects/inbox.json`, drop the
`fields`/schema half (Terraform's job via #253).
- Same idempotency contract as `sync-project.sh`: list items once, ~6
source searches, mutate only new URLs / drifted field values.
- Field/option IDs resolved by name at runtime — spec carries no IDs.
- `.github/workflows/sync-project.yml` becomes a thin `uses:` of the
action; `GITHUB_PROJECT_SYNC_TOKEN` (from #73) preserved, read from
the same env var.
- Retire `scripts/sync-project.sh` once parity is verified on the Inbox
board.

## Acceptance criteria

- [ ] Reusable TS action mirrors items per a declarative in/out spec,
matching `sync-project.sh`'s idempotency contract (steady-state
≈ list + 6 searches, mutations only for new/drifted).
- [ ] Spec carries no field/option IDs; IDs resolved by name at runtime.
- [ ] Action published with a versioned tag and consumable via `uses:`.
- [ ] `.github/workflows/sync-project.yml` invokes the action;
`GITHUB_PROJECT_SYNC_TOKEN` wiring preserved.
- [ ] `scripts/sync-project.sh` removed once parity verified.
- [ ] Docs explain adding a board's sync spec.

## Additional context

- Schema half split to #253 (adopt `github_project_v2` when provider v7
ships; blocked on upstream).
- Pairs with #73 (current bash sync). #187 (sort PRs into Review/Blocked
by actionability) is a future in/out mapping this action's spec should
accommodate.
- `github/projects/bootstrap.sh` (schema applier) stays as break-glass
until the provider resource lands.