feat(generate): emit the opt-in reconcile companion

[joshua-temple]

Problem

The reconcile command exists, but a user repo had no automated way to run it when an external bump changed a governed action pin in a generated workflow. They had to invoke it by hand.

Fix

Adds an opt-in reconcile: config block and, when enabled, emits two workflow files:

• cascade-reconcile-check.yaml: a fork-safe pull_request detector that runs cascade reconcile --check and uploads a data-only relevance artifact with a read-only token.
• cascade-reconcile-companion.yaml: a workflow_run companion that runs against the base definition when the detector reports a governed pin changed. It resolves the PR from trusted workflow_run metadata, fetches a pinned released binary, reads the head files as data, runs reconcile, and pushes the regenerate commit.

Commit routing: append (default) pushes onto the PR head branch, with a sticky-comment fallback for forks; followup opens a separate PR from a cascade-owned branch. A fork PR is never pushed in place. The companion carries the three loop guards (idempotent apply, push-only-if-diff, fresh-tip non-fast-forward abort).

The block is additive at schema_version: 1. source selects the change source (dependabot default) and keeps the lane adapter-shaped.

Verification

• go build ./..., go test ./... (2431 passed), golangci-lint run ./... clean; actionlint clean across all three commit modes.
• New act-driven e2e TestReconcileCompanionAppendsOnSameRepoPR drives the emitted companion through a real Gitea PR and workflow_run event and asserts the bump is pushed and survives regeneration (runs in the CI e2e shard).
• Docs updated in this PR: configuration.md (reconcile block), workflows.md (detector and companion), coverage-matrix.md (rows), README.md. Docs site builds.
• Independent review passed (security, injection-safety, fork-safety, loop-termination all verified).

Closes #443. Part of #440.