ccgram upstream watcher — clean cherry-pick fixes +

OVERRIDES runtime profile: pure git + python (no claude CLI); declared direct_mixed.

Daily 08:30 SAST (06:30 UTC). We run a FORK (branch feat/mc-4139-addtask) that depends on foreign/external tmux-session adoption, which upstream removed in #105. A blind upgrade loses it (see MC-4586). So this watcher does not nag about releases — it surfaces only what's safe to take:

1. #105 adoption status. Checks whether the latest upstream session_map.py still gates adoption to its own tmux session (sentinel: "Only native entries … are processed"). If that gate disappears, foreign-session adoption may be back → high-signal Telegram alert (revisit the MC-4586 re-merge).

2. Clean cherry-pick fixes. For each new upstream commit not yet in our fork, categorises removal/fix/feature and DRY-RUN cherry-picks every fix candidate in a throwaway git worktree (never the live tree). Telegrams Luci the exact git cherry-pick <sha> commands that apply cleanly — a human reviews and applies. Never auto-applies (live bot; release-note wording has misled us twice — #105 read as "adoption" was actually a removal).

De-dupes via state/ccgram_upstream_seen.json (alerts only when upstream HEAD moves or adoption flips). notify_on: failure = scheduler pings only on script error; the script itself sends the findings notification. Old keyword-matching shell version (check_ccgram_update.sh) is superseded but left in place.