docs: add upstream sync procedure

[dzannotti]

Why

GitHub's "N commits behind" counter is git rev-list --count HEAD..upstream/master — pure
graph reachability, unrelated to whether our files match upstream. Squash-merging an upstream
sync copies content without ancestry, so the counter sticks permanently and git merge-base
stops advancing, which makes every subsequent sync replay already-applied commits as conflicts.

We hit both halves of this on #28: the counter is stuck at 72, and the conflict resolution
silently dropped two upstream commits (recovered separately).

What

SYNC.md documents the preferred plain-merge flow, and — for when divergence forces a
reviewed PR instead — the mandatory audit for dropped commits plus the git merge -s ours
step that records ancestry without touching the tree.

Docs only, no code changes.