ci: notify downstream on core PyPI publish

[longieirl]

Summary

• Adds notify-downstream job to release-core.yml that fires after a successful PyPI publish
• Sends a core-released repository_dispatch event to longieirl/bankstatements with the new core version, SHA, and run URL in the payload
• Private repo's new core-release-sync.yml workflow receives this, runs tests, bumps the premium version + core pin, commits, and tags — which triggers release.yml to build and push the Docker image automatically

Secrets required

• DOWNSTREAM_DISPATCH_TOKEN must be set in this repo's secrets — fine-grained PAT scoped to longieirl/bankstatements with Contents: write

Test plan

• CI passes on this PR
• After merge, tag a core-vX.Y.Z release and verify notify-downstream job fires and dispatches to the private repo