Add CI check that vendored dbt-factory is byte-identical to upstream

[park-peter]

Follow-up to #163: a CI-only guard that the vendored databricks-dbt-factory copy has not drifted.

What it checks

A new workflow (.github/workflows/dbt-factory-vendor-sync.yml) verifies, on every PR and merge-group:

1. Byte-identical to upstream — each vendored core file under contrib/dbt_factory/src/databricks_dbt_factory/ matches the upstream databricks-dbt-factory repo at the exact commit named in NOTICE.
2. Byte-identical across copies — the example and the bundle-init template copies are identical to each other (same file set, same bytes).
3. NOTICE consistency — both NOTICE files cite the same upstream commit.

How it pins the version

The upstream commit is read from the Adapted from: commit <sha> (vX.Y.Z) line in contrib/dbt_factory/NOTICE, so bumping the vendored version stays a one-line NOTICE change and the check re-pins to the new commit automatically — no workflow edit needed.

Notes

• CI-only; no scripts or tooling added to the repo tree. The single external action (actions/checkout) is SHA-pinned per the repo's pinned_actions policy.
• Upstream is fetched by exact commit SHA via a shallow git fetch, so the check is fast and unambiguous.
• The check enforces strict byte-identity. If a future version bump ever has to be reformatted (e.g. an upstream/repo ruff-version divergence), the vendored copy would no longer be byte-identical to upstream and the check would flag it — surfacing that case for a deliberate decision rather than letting it pass silently.

[pietern]

Please limit to the contrib/dbt factory path, so it only triggers when those paths are changed.