fix(sync): open a PR when direct push to a protected branch is rejected

[notgitika]

Problem

reusable-sync-from-public.yml pushes clean merges straight to the target branch, but never checks whether that push succeeded (the step runs with set -uo pipefail, no -e). When the caller's branch has a "changes must be made through a pull request" rule, the push is rejected with GH013, and the job still logs ✅ main synced successfully and exits 0.

This is happening today in aws/private-agentcore-cli-staging: every 6-hourly run since late September has "succeeded" while main fell 13 commits behind aws/agentcore-cli.

Fix

• If the direct push is rejected, push the already-committed sync merge to sync-<branch>-<timestamp> and open a PR into <branch>. Skip if an open sync-<branch>-* PR already exists (same dedupe pattern as the conflict path).
• If pushing that branch or creating the PR fails, the job now fails instead of reporting success.
• Unprotected branches: unchanged (direct push still used).

Testing

• actionlint (with shellcheck): no new findings; the one remaining SC2155 warning was already there.
• Ran the extracted step script locally against bare git remotes with a stub gh:
  • protected main (pre-receive hook rejecting pushes): opens a PR from sync-main-*, private .github/workflows/ retained, rc=0
  • protected main + gh pr create failing: rc=1 with ::error::
  • unprotected main: direct push, rc=0 (unchanged)

Callers pin this workflow by SHA, so nothing changes for them until they bump the pin.