Check upstream Solar weekly instead of by hand

[sovanken]

Summary

"Did Iconify add icons?" has come up every few weeks and been answered by hand each time. It's one API call plus a diff against the committed catalog, so this moves it into CI.

Type of change

• Chore (tooling, CI, dependency bump)

No package code changes — nothing ships to pub.dev from this.

What it does

tool/check_upstream.py reports new and renamed icons. It imports fetch_icons and reuses that script's own canonical_names / previously_shipped / resolve_legacy, so the report cannot drift from what a real regeneration would do. It exits non-zero when the API returns nothing — a network failure must not read as "no new icons".

It also distinguishes the three cases that matter:

Bucket	Meaning
Added	actionable — new icons upstream
Renamed	actionable — needs a legacyAliases entry
Retained by design	informational — hidden upstream, kept so existing code compiles (currently just trellis)

That last bucket is why trellis no longer looks like drift every time someone checks.

.github/workflows/upstream-check.yml runs it Mondays 06:00 UTC and on workflow_dispatch. It reuses a single upstream-sync issue rather than filing a fresh one weekly, and closes it automatically once a sync lands.

CONTRIBUTING gains the maintainer sync procedure, including the two traps this repo has already hit:

1. The generator must never drop a name a release shipped — Iconify hides renamed icons from its listing, so a naive refresh would have deleted 1.1.0's 56 @Deprecated constants.
2. Renames aren't the only change. Upstream redraws glyphs in place (eleven in 1.1.0; a malformed bold/logout fixed in 1.2.0). Only a pixel diff catches those, and a single-style sweep is insufficient — check every asset whose bytes changed, since the SVGO pass is deterministic so a changed glyph always changes bytes.

Verified both directions

• Against the current catalog: reports no changes, has_changes=false.
• Against a simulated pre-1.2.0 catalog: correctly finds brain, ticket-star, toolbox, wi-fi as added, plus ticker-star → ticket-star as a rename.

The second test is the important one — a checker that only ever says "nothing new" is worse than no checker, and would look identical to a working one.

Checklist

• flutter analyze reports zero errors
• dart format clean
• Workflow YAML parses; triggers, permissions and steps verified
• CHANGELOG.md — n/a, no packaged change

🤖 Generated with Claude Code