[vitormattos]

Summary

Move the active workflow catalog source machinery into this repository and make the catalog independently reproducible/testable.

• move immutable upstream manifests, vendored Nextcloud workflows, and LibreCode patches;
• move refresh/render/policy tooling and their unit tests;
• run upstream verification/render checks directly here;
• move the scheduled upstream refresh workflow and target this repository directly;
• add workflow policy and REUSE validation here;
• configure Dependabot for /workflow-templates;
• preserve already-reviewed full-SHA Action pins in materialized templates when upstream rendering runs, so Dependabot updates are not silently reverted;
• move the current upstream/dependency policy documentation.

This covers the core of #54 and #56. It intentionally does not migrate retired release templates or the old github-workflows -> .github publication machinery.