Adopt labkit engine for Intelligence Flow sync

[bigboateng]

What

Replaces the hand-authored sync-upstream.yml with the version-controlled control
plane generated by labkit in the upstream monorepo. The projection is now
driven by the single engine (python -m labkit project) from a declarative
publish.config.json, retiring this workflow's bespoke inline rsync body.

Why

The old workflow's rsync sync and the upstream build_pitot.py drift-check could
silently disagree. Both sides now run the same engine, so they can't diverge. The
generated file is reviewed upstream and drift-gated by labkit doctor.

Notable changes

• Projection body: inline rsync/cp → python -m labkit project --config … --write.
• Adds a Python setup + pip install ./intelligence-flow/labkit step.
• Token now scopes both intelligence-flow and pitot (checkout + install upstream).
• Provenance UPSTREAM.json (with source.commit) drives the stale-guard.
• Deterministic cron (59 */6).

⚠️ First run needs a one-time --adopt

This repo's tree predates the projection manifest, so the first engine run will
hit the collision guard (it refuses to clobber files it doesn't yet own). Do not
rely on the scheduled run for the initial sync. Bootstrap once, from a clone:

# in a clone of operatorstack/intelligence-flow at the desired commit:
python -m labkit project \
  --config labs/15-pitot/publish.config.json \
  --repo /path/to/pitot-checkout \
  --source-commit "$(git log -1 --format=%H -- labs/15-pitot)" \
  --write --adopt
# commit + push the pitot checkout; this seeds UPSTREAM.json and manifest ownership.

After that one adopt, the scheduled workflow takes over normally. Merging this PR
only installs the workflow — it does not itself sync.