feat(digest): rebase opted-in fork feature branches nightly

[dnplkndll]

What changed

The daily org digest (fork-sync-and-digest.yml) synced each fork's mirror branches via merge-upstream but did nothing for feature branches — once their base advanced they silently went stale (ddmrp's are 9–96 commits behind today).

New: opt-in rebase_globs in forks.yml. For each matching branch the collect step rebases it onto the freshly-synced upstream_track base and force-pushes the clean ones with the fork-sync PAT (so the fork's tests/pre-commit re-run — a GITHUB_TOKEN push wouldn't). Conflicts are reported, never pushed.

Enabled on ledoent/ddmrp (19.0-mig-*, 19.0-fix-*) so its ~16 not-yet-upstreamed submodule MIGs stay mergeable for the 1–2-PR/day upstreaming cadence.

Digest surface

• New Feature-branch rebases section: rebased / already-current / conflict (needs manual rebase before its PR).
• Subject gains a ⚠️ N rebase conflict tag. Conflicts are actionable but not a script failure — digest.exit stays 0.
• rebase-results.json added to the run artifact.

Also carried (was already staged)

• The in-progress ledoent-overlay rebase check (check_ledoent_branch) + its workflow setup (Python, git-aggregator, git identity).
• The install_forward_port: true → false flips across OCA forks.

Notes for review

• timeout-minutes 15 → 30 (collect now clones+rebases, not just API calls).
• The git rebase/push path runs only against a live fork on the runner; unit tests pin the branch-glob selection + no-match short-circuit, and the digest render (pytest .github/scripts/tests/ → 39 passing).