test(ci): harden upstream sync wrapper shell test

[pRizz]

Summary

• Rebuilds this branch from upstream/main.
• Hardens the upstream sync shell-wrapper test by pinning fake shell fixtures and wrapper execution to /bin/bash.
• Excludes fork-owned paths and does not alter runtime sync behavior.

Why

While syncing a downstream fork, the wrapper test exposed shell/PATH sensitivity in the local test harness. This keeps the shared test deterministic without carrying any fork-specific sync behavior.

Validation

• bun test scripts/github-actions/upstream-sync-sh.test.ts
• bun run test:deploy
• bun run biome:check
• bun run studio:lint
• bun run typecheck
• bun run studio:typecheck
• bun run --filter @openlinks/studio-api test
• bun run studio:test:integration

PR Hygiene

• Branch was rebuilt from upstream/main.
• Diff contains only scripts/github-actions/upstream-sync-sh.test.ts.
• Fork-owned paths are excluded.