feat(preflight): detect stale contributor forks

[morluto]

Fixes #271.

Problem

workflow.preflight_contribution could not determine whether a contributor fork's default branch was stale or diverged from upstream, so publishing through that fork could carry unrelated history into the contribution path.

Change

• Add optional fork context, inferred from an unambiguous workspace remote or an existing pull request when available.
• Read upstream and fork metadata and default-branch tips, verify the fork parent, and compare cross-fork refs through GitHub.
• Return current, behind, diverged, or unavailable with branch SHAs, merge-base evidence, effective-diff risk, and a recovery action.
• Preserve the read-only boundary: no local fetch, fork sync, force-push, or GitHub mutation.
• Document the contract and add adapter and preflight regression coverage.

Validation

• make verify — passed

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.