ci: keep fork and Haskell branch synced upstream

[michelguillaume]

Summary

• Syncs TontineTrust/codegraph:main from colbymchenry/codegraph:main every day at 05:17 UTC and on manual dispatch.
• While upstream PR colbymchenry/codegraph#1337 is open, merges the same upstream commit into feat/haskell-support-clean.
• Runs the full test suite on Node 22 LTS plus build and npm package verification before pushing an updated Haskell branch.

Safety

• Uses merge commits only; it never rebases or force-pushes either branch.
• A conflict or failed validation stops the workflow before the feature branch is pushed.
• Uses the repository-scoped GITHUB_TOKEN; no PAT or external secret is required.
• The token is only exposed to the API/push steps, not to npm ci, build, or tests.
• Once upstream PR feat(haskell): add module-aware extraction and resolution colbymchenry/codegraph#1337 is no longer open, feature-branch updates are skipped while the fork's main can continue tracking upstream.

Validation

• Workflow YAML parsed locally.
• Fork Actions are enabled and the default workflow permission is contents: write.
• Fork main was fast-forwarded to current upstream b8833fe before this PR, so this PR contains only the workflow.