ci: make release sync fallback idempotent

[cafitac]

Summary

• make the protected-main release fallback safe to rerun after partial success
• reuse an existing release-sync/vX.Y.Z branch instead of failing on non-fast-forward push
• detect an existing open release-sync PR and exit successfully instead of opening duplicates
• refresh release docs and current handoff

Tests

• uv run pytest tests/test_release_workflows.py tests/test_published_install_smoke.py -q
• uv run pytest tests/ -q
• uv run python scripts/check_release_metadata.py
• uv run python scripts/smoke_release_readiness.py
• npm pack --dry-run
• git diff --check
• node --check bin/agent-memory.js
• static diff secret scan: finding_count: 0

Live verification plan after merge

1. Confirm auto-release attempts v0.1.33 metadata bump.
2. Confirm protected-main fallback creates or reuses release-sync/v0.1.33.
3. Merge the release-sync PR.
4. Confirm the release-sync follow-up job creates tag v0.1.33 and dispatches publish.yml.
5. Verify GitHub Release, npm, PyPI, and published-install-smoke artifact.