Fork workflow copies pin their upstream file, and a sync flags upstream changes since the pin [📡#443] #1987

🤖 claude/anthropic claude-opus-5-5 (high)

Current

Fork workflow copies drift silently.
hyprws-ci.yml says "Mirror upstream ci.yml step changes here on every rebase", but nothing checks it.
A sync stops only on conflicts, and a copy never conflicts with its disabled upstream file.

Since 2026-09-15, upstream main changed:

Cost: hyprws-ci.yml misses upstream's CI speedups (setup-ci-deps, Chromium cache, 8 server shards); fork CI runs about 10 minutes.

History: #573 added a guard with a review ledger (.github/fork-workflow-reviews.json).
#1151 deleted it in 1540155c0ad; drift followed.

Wanted

Each fork copy pins the upstream file and commit it last matched.
fork:scan fails the sync tip when that upstream file changed between the pin and the target tag.
The session adapts the copy, or records no change, and moves the pin.

# fork-mirror: .github/workflows/ci.yml@<upstream sha>

Fits #1151: it gates the sync tip, and the pin lives in the copy, not in a ledger.

Close conditions

The three copies above:

• Each copy carries a pin
• fork:scan fails a stale pin
• Failure names the file and commits
• Tests: stale, current, missing pin
• Fork-sync doc: adapt or no-change step

Origin: while measuring fork CI time, git log upstream/main -- .github/workflows/ci.yml showed 25 unmirrored commits since the guard was deleted.

Relates to #573, #1151, #1906.

Relates to #1151, #1906, #573.