chore: configure Python template synchronization

[thom-techlete]

What changed

• Adds the target-owned .template-sync.yml for TECHLETES/python_template, using main as this repository's only integration branch.
• Adds the reusable template-sync caller and a local post-merge reconciliation workflow.
• Removes the devcontainer attach hook's remote fetch and merge behavior; opening a devcontainer no longer changes Git history.

Why

A previous one-off template adoption was merged, but the permanent synchronization model was not configured. The new setup establishes the required first phase without touching generated SDK clients or application behavior.

Follow-up required before the first sync

Repository administrators must configure:

• Actions variable: TEMPLATE_SYNC_APP_CLIENT_ID
• Actions secret: TEMPLATE_SYNC_APP_PRIVATE_KEY

The existing active template-sync ruleset already protects refs/heads/chore/template-sync from deletion and non-fast-forward updates, with the approved integration bypass.

After this PR is merged, create chore/template-sync from main and trigger Sync template. The first synchronization PR must be reviewed and squash-merged without deleting the permanent branch.

Validation

• git diff --check
• bash -n .devcontainer/post-attach.sh
• YAML parsing and canonical managed-path comparison against live TECHLETES/python_template/main
• uv run pre-commit run --files .template-sync.yml .github/workflows/template-sync.yml .github/workflows/reconcile-template-sync-branch.yml .devcontainer/post-attach.sh
• uv run pytest (5 passed)