Adopt labkit engine for Intelligence Flow sync

[bigboateng]

What

Replaces the hand-authored sync-upstream.yml with the version-controlled control
plane generated by labkit upstream, driven by the shared engine
(python -m labkit project) from publish.config.json.

Why

The old workflow ran scripts/project_upstream.py — a script that lived only in
this public repo, reviewed nowhere central, and had no stale-guard. The engine is
reviewed upstream, drift-gated by labkit doctor, and shared with Pitot/Boatstack.

Notable changes

• Projection body: project_upstream.py → python -m labkit project.
• Adds a stale-guard (ignores out-of-order/older source commits) — previously absent.
• Adds Python setup + pip install ./intelligence-flow/labkit.
• Token now scopes both intelligence-flow and value-map with contents:write.
• Deterministic cron (9 */6).

Merging installs the workflow. On the first run the engine writes a projection-style
UPSTREAM.json; the existing tree was produced by the same source, so review the
first sync PR's diff before merging it.

[bigboateng]

Closing as stale: this bootstrap predates the canonical upstream-sync reliability control now shipped from operatorstack/intelligence-flow@c7c89a11d5f0. It must not be merged as-is; the live workflow should be replaced from the current generated control plane.