Build for 0c2eb38 feat: combine add-repo.sh and CI generator from #434 and #505

Replaces the script work of two prior PRs that independently solved
"add an existing scratchfoundation repo to the monorepo":

scripts/add-repo.sh — collapses add-to-monorepo.sh (#434) and add-repo.sh
(#505) into a single canonical entry point. Takes the CLI shape and
auto-CI-regen from #505 and the source-branch auto-detect (develop ->
main -> master), normalization (sort-package-json), and clean-tree
pre-flight from #434.

scripts/update-gha-workflows.ts — replaces the CircleCI-era
build-gha-workflows.ts and workspace-template.yml. Regenerates
.github/path-filters.yml and incrementally updates publish.yml.

Open review comments on #505 are addressed:

- sed -i portability bug: rewrites now use perl -pi -e (works on macOS,
  NixOS, Ubuntu/Debian/Arch, WSL). Perl is added to the explicit prereq
  check next to git-filter-repo, sponge, and jq.
- Arg parser now rejects flag-stealing: --source-branch --org foo errors
  instead of silently using --org as the branch name.
- npm-install failures hard-fail by default. --continue-on-error opts
  into the prior soft-fail behavior; failures are still logged to
  add-repo.errors.log when continuing.
- The submodules-aware branch in move_repository_subdirectory keeps a
  TODO comment marking that it has never been exercised against a real
  submodules-bearing repo and should be run carefully when one lands.

Cross-workspace dep handling: rewires both bare-name and already-prefixed
@scratch/<name> deps in the new package to exact-pinned current monorepo
versions. Matches the existing convention in scratch-gui/scratch-vm/
scratch-render. npm's workspace: protocol would be the ideal here but
npm does not actually support it (npm/cli#8845 - EUNSUPPORTEDPROTOCOL
at install time).

Workspaces array ordering: the new package is inserted just after the
latest existing workspace it depends on, so 'npm run --workspaces build'
builds its deps first. Falls back to position 0 (prepend) when the new
package has no monorepo deps. This is a "last dep wins" heuristic, not
a full topo sort; a real topo sort can be added later by extending
update-gha-workflows.ts if needed.

bash 3.2 compatibility: macOS ships bash 3.2 at /bin/bash, which lacks
the 'mapfile' builtin. The find/grep output is collected via a 'while
IFS= read -r' loop so the script runs on macOS as well as Linux.

No repo additions are included; this PR is script-tooling only.

Author: cwillisf