DIVE-4069: widen the file-size ratchet base-ref gate to any dive-*-sync branch

[lodar]

What this fixes

The DIVE-3850 file-size-ratchet protection is gated on a branch-NAME suffix, and week-4's sync
branches did not have it — so the protection has been silently disengaged.

L135  CHECK_FILE_SIZES_BASE: ${{ (startsWith(head_ref,'dive-') && endsWith(head_ref,'-upstream-sync')) && '<sha>' || '' }}
L39   fetch-depth:           ${{ (!(startsWith(head_ref,'dive-') && endsWith(head_ref,'-upstream-sync'))) && 2 || 0 }}

Week 3 used dive-3708-upstream-sync and matched. Week 4 used dive-4051-buzz-sync /
dive-4051-chat-sync and does not end in -upstream-sync, so the predicate is false, the env
is the empty string, and resolveBaseRef (scripts/check-file-sizes-core.mjs:45-51) falls back to
HEAD^1 under GITHUB_ACTIONS. On a wholesale sync merge HEAD^1 is our PRE-merge main, so the
ratchet reads ~77 upstream commits as this PR's own diff — the exact false-red DIVE-3850 was built
to kill. fetch-depth also drops to 2, so the history the fix needs is not even fetched.

Why it was not noticed

It did not fire. No size check went red on week 4 (buzz#15@76ec11e9f, 5dive-chat#8@8334236d3) —
the sync happened not to trip a threshold. A disengaged guard and a satisfied guard are the same
colour. The next sync that touches a big file eats the false-red plus the skip cascade: the red
early gate SKIPS the Mobile/Unit matrix, and the weekly sync stops being gradeable without a human.

The change

Both lines move from endsWith(head_ref, '-upstream-sync') to contains(head_ref, '-sync'),
keeping the startsWith(head_ref, 'dive-') leg. Chosen over the alternative — "rename the weekly
sync branch to the old convention and write it down" — because that one depends on a human
remembering a suffix every week, which is the failure that produced this.

A comment naming DIVE-4069 is added so the next reader sees why the predicate is loose.

Residual, deliberately NOT fixed here

CHECK_FILE_SIZES_BASE is a hardcoded per-sync sha (c3132c3e, week 3's upstream parent) that the
existing comment says "MUST be updated by each weekly sync row". Widening the predicate means a
sync row that forgets to update the sha now gets a stale base instead of falling through to
HEAD^1 — a different silent-disengagement of the same class. That is a real follow-up and it is
out of scope for a two-line predicate repair; it needs the sha derived rather than pasted.

Provenance

Found by quinn while grading DIVE-4056 (week-4 buzz upstream sync), independently re-derived on
BOTH forks at the graded heads; olivia signed the same finding in her own grade rather than hiding
it, and authored this fix. The identical change is already open as 5dive-ai#16 — both forks vendor
the same gate, and these two lines have now drifted to the same predicate twice.

DIVE-4069.