Tracking: upstream array-API blockers (astropy, reproject, astroscrappy)

### Purpose

Single place to track the upstream dependencies that currently force ccdproc data back to numpy, with links to upstream issues as they are filed, and the interim decision for each (vendored replacement vs. CPU-only policy vs. wait).

### Blockers

- [ ] `astropy.stats.sigma_clip` — uses `np.asanyarray` + `np.ma` internally (used by `Combiner.sigma_clipping`). Interim: #1001 gives every non-numpy backend an xp-native clip; numpy keeps calling astropy. Separately, the compiled `_sigma_clip_fast` path reads out of bounds (intermittent segfault, wrong mask when it survives) whenever an iteration empties a slice — filed as astropy/astropy#20331; this affects the numpy path too, so watch for the fix version
- [ ] `astropy.stats.median_absolute_deviation` — numpy-only (default `sigma_func` for `median_combine`)
- [ ] `astropy.nddata` `block_reduce` / `block_replicate` — force `np.asanyarray` on inputs
- [ ] `CCDData` / `NDData` arithmetic — numpy-based (see TODO at https://github.com/astropy/ccdproc/blob/9d25eeefda8a38fc442c1a18e79ca2fa8ca40559/ccdproc/core.py#L1016 and the `_CCDDataWrapperForArrayAPI` workaround)
- [ ] `astropy.modeling` fitters — numpy internals (used by `subtract_overscan`, `create_deviation` paths)
- [ ] `astropy.units.Quantity` — numpy-backed (#936)
- [ ] `reproject` — CPU-only (used by `wcs_project`)
- [ ] astroscrappy — C extension, CPU by design (used by `cosmicray_lacosmic`); realistically permanent → document under the CPU-only policy (#935)
- [ ] `__array__(copy=...)` numpy-2 protocol warning — origin upstream, see #934

For each: file or link the upstream issue, and note the interim plan here.

---
Follow-up to #909. Found during a review of the array API implementation from #885.

Start with the blocker list, follow the referenced issues (#1001, #934–#936, #935) and inspect the TODO in ccdproc/core.py around line 1016, including the _CCDDataWrapperForArrayAPI workaround. For each dependency, record or link the upstream issue and document the interim decision; done means every listed blocker has both an upstream reference and an interim plan.

Written by the indexing model from the issue text.