feat: add reusable pre-commit autoupdate workflow

[j7an]

What

Adds a reusable pre-commit-autoupdate.yml workflow for sibling repos.

• centralizes weekly/manual pre-commit hook update PR creation
• recommends Release Bot GitHub App auth when required checks exist
• keeps a deliberate GITHUB_TOKEN fallback with a generated stuck-PR caveat
• supports optional pre_commit_version, alternate config_path, path-restricted PRs, signed commits, and branch cleanup
• adds preflight behavior tests, workflow contract tests, inline-sync coverage, and public docs

Fixes #90.

Verification

• rtk bats tests/ passed: 286 tests, with the known pre-existing BW01 warning from tests/lint-workflows.bats
• rtk ./scripts/check-inline-sync.sh passed
• rtk ./scripts/lint-workflow-call.sh passed
• rtk ./scripts/lint-workflows.sh passed
• rtk git diff --check origin/main...HEAD passed
• final whole-branch review found no blocking issues

Follow-up

Pre-migration parity gate: from the same sibling repo/config state, compare the diff from uv run pre-commit autoupdate with the diff from uvx pre-commit autoupdate. This may require network access and is intentionally not a standing Bats test.