Add CLI workflow to link and sync GitHub projects

Parent: safedep/control-tower#573

Raised from the review of #30.

Problem

safedep project scan create <project-name> can scan only an existing SafeDep project with an active GitHub repository binding. The CLI currently offers no project-domain workflow to establish that prerequisite. A user who knows a repository name but has not linked or materialized it must leave the CLI and discover the GitHub App setup flow elsewhere.

Goal

Provide a CLI workflow, proposed as:

safedep project sync --github

The workflow should use the IntegrationService operations owned by safedep/control-tower#573 to guide the user from tenant GitHub-link status to canonical SafeDep projects that are ready for safedep project scan create.

Required behavior

• Read GitHub App installation links for the active tenant.
• When no usable tenant link exists, return an actionable GitHub installation/link URL and create no project state.
• When a usable link exists, select repositories through immutable GitHub repository IDs and call the appropriate project-materialization API.
• Keep GitHub credentials and authoritative repository metadata inside Control Tower.
• Return the materialized SafeDep project names and IDs so the user can submit a Project Scan.
• Use the CLI's structured useful-error presentation for stale, removed, suspended, conflicting, or unauthorized installations.
• Document the workflow and cover link-state, selection, materialization, and partial-failure behavior with tests.

Open UX decisions

• Whether project sync --github is the final command shape or whether a more explicit nested noun better matches the command conventions.
• Whether repository selection is interactive, flag-driven, or supports both.
• Whether the command handles one repository per invocation or a bounded batch.

Non-goals

• Starting a Project Scan automatically. Scan submission remains safedep project scan create.
• Adding GitHub credentials or direct GitHub API calls to the CLI.
• Reimplementing linking or project materialization outside Control Tower.
• Background full-installation repository inventory.

Start by reviewing the existing project scan CLI command conventions and the IntegrationService operations owned by safedep/control-tower#573. Resolve the command and repository-selection UX, then cover link-state, selection, materialization, and partial-failure behavior with tests and documentation. Done means linked repositories produce canonical SafeDep project names and IDs without moving GitHub credentials or API calls into the CLI.