fix(digest): treat distributor+merge overlay as managed, not diverged

[dnplkndll]

What changed

The daily fork digest flagged 14 forks as ⚠️ diverged every run. All 14 share the same root cause: install_forward_port: true forks carry a chore(ci): … forward-port.yml from ledoent/.github distributor commit on every series branch (the distributor writes it via Contents API to the default branch, which IS the series branch on OCA forks), and merge-upstream then layers a Merge branch 'OCA:<b>' into <b> commit on top each time upstream advances.

Both are structural — the workflow file must live on the branch where pull_request_target events fire, so this overlay isn't human error. The alarm was a false positive.

This PR adds MANAGED_COMMIT_PATTERNS in fork_sync_digest.py, classifies ahead-commits as managed vs. unmanaged, and:

• Sets diverged: true only when there's an unmanaged ahead-commit (someone actually pushed work to a series branch — the case the original check was designed for).
• Sets a new managed_overlay: true for the steady-state overlay case.
• Renders managed-overlay branches as a one-line grey footer, not a red alarm. Subject line stays quiet.
• When a real divergence is found, the body now lists the unmanaged commit subjects (up to 5) so the fix is obvious.

Why not "fix" by resetting the 14 branches

Considered + rejected. The distributor would re-add forward-port.yml on the next run and the cycle restarts. The chore commit is the intended state, not drift.

Test plan

• pytest tests/ — 29 passed (4 new tests cover managed-overlay classification + render footer)
• Manual render against simulated May-25 state: subject = Ledoent digest 2026-05-25 (no ⚠️), footer reads Managed overlay: 2 branches are 1+ ahead of upstream only by structural commits
• First post-merge cron run produces a clean inbox

Side effect

HEADERS in fork_sync_digest moved from module-level init to lazy init inside main(), so render_digest can import MANAGED_COMMIT_PATTERNS without requiring GH_TOKEN in the render step's env.