[product-manager-impersonator] Publish installable Workflow Upgrade Check detector

## Feature Idea

**Summary:** Add a customer-facing `workflow-upgrade-check` scheduled detector that reuses the existing internal upgrade-check logic to flag deprecated workflow refs and version drift in consumer repos.

## Why a Customer Would Want This
Teams install workflows once and then drift behind rename/deprecation changes over time. A periodic advisory issue would give maintainers early, actionable upgrade guidance before workflows break or accumulate migration debt.

## Rough Implementation Sketch
- Add a new reusable workflow source (for example `.github/workflows/gh-aw-workflow-upgrade-check.md`) that packages the existing `upgrade-check.md` logic for `workflow_call` consumers.
- Add `gh-agent-workflows/workflow-upgrade-check/{README.md,example.yml}` so users can install it like other detectors.
- Keep it report-only (`create-issue`/`noop`) with dedupe controls; no auto-edits or auto-PRs.
- Link it from upgrade and workflow catalog docs.

## Why It Won't Be That Hard
Most of the product logic already exists in `.github/workflows/upgrade-check.md` (release comparison, impact assessment, issue reporting format). This is mainly surfacing and packaging an internal workflow into the existing published detector pattern.

## Evidence
- Internal upgrade capability already exists: `.github/workflows/upgrade-check.md` (name/description and scheduled report behavior at lines 3-4, 49-56, 60-69).
- Repo docs explicitly classify `upgrade-check` as internal-only and non-installable: `docs/developing.md:11`, `gh-agent-workflows/DEVELOPING.md:80`.
- Public workflow catalog/quick setup do not offer any upgrade-check detector today: `gh-agent-workflows/README.md:56-80`, `scripts/quick-setup.sh:120-142`.
- Upgrade churn is already a real maintenance task in this repo: open issue `#998` (`[gh-aw-upgrade] ...`).
- Nearest existing PM issue is different: `#757` proposes an auto-migration assistant that opens PRs, while this proposal is a report-only detector that continuously warns about drift.

> [!NOTE]
>
> 🔒 Integrity filter blocked 20 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - elastic/ai-github-actions#1029 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#1025 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#1024 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#359](https://github.com/elastic/ai-github-actions/issues/359) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#937](https://github.com/elastic/ai-github-actions/pull/937) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#392](https://github.com/elastic/ai-github-actions/pull/392) `list_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#704](https://github.com/elastic/ai-github-actions/issues/704) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#694](https://github.com/elastic/ai-github-actions/issues/694) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#684](https://github.com/elastic/ai-github-actions/issues/684) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#875](https://github.com/elastic/ai-github-actions/issues/875) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#676](https://github.com/elastic/ai-github-actions/issues/676) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#235](https://github.com/elastic/ai-github-actions/issues/235) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#225](https://github.com/elastic/ai-github-actions/issues/225) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#19](https://github.com/elastic/ai-github-actions/pull/19) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#240](https://github.com/elastic/ai-github-actions/pull/240) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#703](https://github.com/elastic/ai-github-actions/pull/703) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - ... and 4 more items
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/25104030724)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.