Automate subtree snapshot synchronization

[Maple127667]

Summary

• add a daily and manually-triggered subtree snapshot workflow
• restrict synchronization to 8 main repositories, 12 direct dependencies, and 3 nested dependencies
• push validated snapshot commits to dev only, then create or refresh a dev → main PR
• append success, no-change, or failure reports to the configured Feishu document
• when real repository files change, send one signed Feishu group card after the document report succeeds
• show only changed repositories and files; omit unchanged repositories
• synchronize the currently pending nested rpo_description snapshot update

Group notification format

• blue card titled roboto_origin 子仓库快照有更新
• Beijing time, changed repository count, file totals, and add/delete totals
• per-repository upstream commit range, changed files, and line statistics
• one 前往飞书文档 button; no PR or Actions links are exposed to group recipients
• no group notification for no-change or failed synchronization runs

Safety boundaries

• the only workflow push target is refs/heads/dev; there is no direct main push or automatic merge
• pushes are non-forced and guarded by the previously observed remote dev SHA
• unknown .gitmodules entries, unknown gitlinks, ordinary conflicts, out-of-scope paths, or oversized deletions fail before push
• upstream code is imported but never executed
• Feishu document and group credentials are isolated to separate reporting jobs
• the custom-bot webhook is restricted to the expected Feishu v2 endpoint and requests use signature validation
• Actions are pinned to full commit SHAs

Validation

• Python compilation and YAML parsing passed
• group-card signature, webhook validation, document URL validation, no-change skip, secret isolation, and payload-size fallback passed
• all 23 allowlisted repositories match the current .gitmodules declarations
• a real local snapshot run succeeded and updated 5 source histories; the final tree changed only 2 nested rpo_description files (314 insertions)
• a second run reported all 23 repositories unchanged and created no commit
• no gitlinks, unresolved paths, or changes outside modules/ remain

Activation note

GitHub only registers a new workflow_dispatch workflow after it exists on the default branch. After this PR is reviewed and merged with Create a merge commit, the workflow can be manually dispatched from Actions; scheduled runs occur daily at 09:10 Asia/Shanghai.