Read-only health check that flags repos missing their synced .mokogit/workflows/ (non-zero
exit) with optional critical ntfy push (--alert-ntfy) and auto-filed Git issue (--alert-issue).
Adds --repo-filter to scope sync/health. Registers workflow:sync in bin/moko.
Ported from the superseded PR #356 onto current main (the rest of #356 — rebrand, manifest
retirement, template maps — already landed on main via #317-#355).