chore: add CI guard against stale image-version metadata

[hbanerjee74]

Why

The vibedata image tag is derived from .accelerate/upstream-sync.json. The Upstream Sync workflow writes it automatically, but manual sync merges bypass that — which is exactly how it drifted to v0.23.0 while the code moved to v0.23.2 (#16, fixed in #17).

This adds a guard that catches the drift regardless of how a sync happened.

What

• scripts/verify-sync-metadata.sh — validates the metadata shape (valid JSON, vX.Y.Z version, 40-hex SHAs) and enforces the drift rule below.
• .github/workflows/verify-sync-metadata.yml — runs the script on every PR to main (and on push to main), fetching upstream release tags first.

Drift rule (no false positives)

The recorded upstreamObotVersion must not be behind the highest stable vX.Y.Z tag actually merged into HEAD.

• A sync branch merges a newer upstream tag → if metadata isn't bumped, the check fails with an actionable message.
• An ordinary feature branch doesn't advance the merged upstream tag → check is a no-op.
• RC/malformed tags (e.g. v.0.23.2-rc1) are excluded.

It does not fail merely because upstream released a newer version the fork hasn't synced yet — only when newer upstream content is actually present in the branch but the metadata wasn't updated.

Verification (local)

# current main — passes
OK: upstreamObotVersion=v0.23.0; highest merged upstream tag=v0.23.0

# simulated branch that merges v0.23.2 without bumping metadata — fails
FAIL: image version metadata is stale: HEAD contains upstream release v0.23.2,
      but .accelerate/upstream-sync.json records v0.23.0. ...

Note

Best merged after #17 (which bumps the metadata to v0.23.2 and hardens the auto-resolver). On current main this check passes either way, since v0.23.0 metadata matches the merged tag.

🤖 Generated with Claude Code