feat(sync): update upstream drift issues by fingerprint

[mkdev5]

Summary

• Closes feat(sync): auto-file upstream drift issues with dedupe fingerprints #88.
• PATCH existing upstream drift issues when a matching fingerprint or recorded issue link exists, instead of treating local D1 linkage as an update.
• Reuse one GitHub issue payload for create/update so body, source paths, suggested tests, labels, and assignees stay aligned.
• Add regression coverage for fingerprint dedupe updates, linked issue updates, update failure skips, and public-body safety.

Validation

• npm run test:ci
• Changelog updated only if this is a release-prep change (N/A, not release prep)

Safety

• Backend-only change
• No secrets, wallet details, user PATs, raw trust scores, or private rankings exposed
• Public text avoids compensation-seeking or optimization-tactic language
• OpenAPI/MCP behavior updated where needed (N/A, internal job behavior only)
• Public docs/changelogs updated where needed (N/A)

[mkdev5]

@JSONbored can you please review my PR?

[JSONbored]

@MkDev11 This is ready from my side.

A few notes:

• The updated flow handles the important operational case: existing open drift reports now update the existing GitHub issue instead of silently skipping once an issueUrl is present.
• The recordedGitHubIssue(...) ?? findGitHubIssueForFingerprint(...) order is right. It avoids unnecessary issue-list scans when the report already has a canonical issue number, while still preserving fingerprint recovery for older records.
• The shared create/update payload helpers keep the issue title, labels, assignees, marker, changed upstream source summary, and suggested tests aligned across both paths.
• The new tests cover create, update by fingerprint, direct linked-issue update, failed update, malformed payload, source-path summaries, and public-safe body language.
• Current validate, Contributor trust, and Superagent checks are green, and the merge-tree is clean.

No requested changes from me.