ci: add verify-sync workflow for monorepo drift detection

[johnformio]

Summary

Adds .github/workflows/verify-sync.yml (and a companion .github/sync-verify.yml exclude config) that runs only on sync PRs opened by formio/gh-workflows:bin/sync-oss.mjs. The job pulls down formio/nirvana at the SHA stamped in the PR body's <!-- formio-sync-meta ... --> marker, runs verify-oss-sync.mjs against this repo's PR head, and posts a sticky comment summarising any drift. Critical drift (OSS contains changes not in nirvana) fails the check; informational drift (nirvana has content the PR doesn't) just reports.

Regular PRs (dependabot, community contributions, hotfixes) lack the marker, so the job is skipped — no comment, no noise.

Prerequisites

• Repo (or org) secret MONOREPO_SYNC_TOKEN with read access to formio/nirvana and formio/gh-workflows.
• formio/gh-workflows main must contain bin/verify-oss-sync.mjs and oss-templates/. These currently live on the per-release-oss-sync branch — until that merges to main, this workflow will fail at the "Checkout gh-workflows (verify tool)" step on any sync PR. Hold merging until then, or merge now and accept that the next sync PR will surface the missing-tool error and need to be re-run after gh-workflows is updated.

Test plan

• Confirm MONOREPO_SYNC_TOKEN is set on this repo (or inherited from the org).
• Confirm formio/gh-workflows@main carries bin/verify-oss-sync.mjs before the next sync PR opens.
• After both prerequisites are met, the next release: <pkg>@<version> PR from sync-oss.mjs should show a green verify-sync / compare check with a sticky comment.