docs(fork): carried files for the sync's App push and Renovate off

fork/carried/chore-declare-renovate-off-on-the-fork-line.md

@@ -0,0 +1,3 @@
+| Carried commit (subject) | Why the platform needs it | Upstream |
+|---|---|---|
+| `chore: declare Renovate off on the fork line` | upstream owns the dependency graph: a bump opened on the line would diverge from the pin and every re-pin would have to carry or revert it, so the consumed branch carries a hand-written `renovate.json5` with `enabled: false` and the reason, and dependencies move when the line is re-pinned; a real GitHub fork is skipped by Renovate's autodiscovery until it carries a configuration of its own, so the declaration is what keeps the line off Renovate once it has one | fork-only, never upstream |

fork/carried/fork-mirror-as-the-app-and-cancel-the-runs.md

@@ -0,0 +1,3 @@
+| Carried commit (subject) | Why the platform needs it | Upstream |
+|---|---|---|
+| `ci(fork): mirror as the App and cancel the runs upstream's files start` | the sync's first run was refused at the mirror: a workflow's own token may not update a workflow file, not even in a mirrored upstream commit, whatever `permissions:` grants, so the mirror is pushed with the App's token like the candidate and the consumed branch; an App push starts upstream's workflow files at the mirrored refs (runners the fork does not have, registries it must not touch), so `mirror.sh` records what it pushed and `mirror-quiet.sh` cancels those runs right after, and the ledger stays on `GITHUB_TOKEN` | fork-only, never upstream |

fork/carried/fork-open-the-syncs-pull-requests-in-this-repository.md

@@ -0,0 +1,3 @@
+| Carried commit (subject) | Why the platform needs it | Upstream |
+|---|---|---|
+| `ci(fork): open the sync's pull requests in this repository, not the parent` | in a checkout of a fork, `gh pr create` resolves the base repository to the parent unless `--repo` is given, and the App is not installed there: the sync's second run failed at its "checks red" step with `Resource not accessible by integration (createPullRequest)`; both calls name this repository, and `git-push-as.sh` masks its credential line only under GitHub Actions, where a manual re-pin had printed it to the terminal | fork-only, never upstream |