auto-strip upstream CI/CD files on every sync

.github/workflows/sync-and-build.yml

@@ -52,6 +52,33 @@ jobs:
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Strip upstream-only CI/CD files
+        # Апстрим хранит у себя dependabot.yml и CI-workflow'ы, которых нам
+        # не нужно в приватном форке (плодят PR/раны, требуют чужих секретов).
+        # Merge может притащить их обратно — вычищаем перед пушем.
+        if: steps.sync.outputs.changed == 'true'
+        run: |
+          FILES=(
+            .github/dependabot.yml
+            .github/workflows/ci.yml
+            .github/workflows/codeql.yml
+            .github/workflows/docker.yml
+            .github/workflows/lint.yml
+            .github/workflows/release-please.yml
+            .github/workflows/release.yml
+            .github/workflows/security-audit.yml
+          )
+          REMOVED=false
+          for f in "${FILES[@]}"; do
+            if [ -e "$f" ]; then
+              git rm -q "$f"
+              REMOVED=true
+            fi
+          done
+          if [ "$REMOVED" = true ]; then
+            git commit -q -m "chore: strip upstream CI/CD workflows not needed in this fork"
+          fi
+
       - name: Push merged main back to fork
         if: steps.sync.outputs.changed == 'true'
         run: git push origin HEAD:main