ci: weekly SDK compliance sync via supabase/sdk reusable workflow

[spydon]

Adds a weekly workflow that keeps this repo's sdk-compliance.yaml in sync with new capability IDs from the canonical spec at https://github.com/supabase/sdk.

It's a thin caller for the reusable workflow added in supabase/sdk#65, mirroring the existing validate-capabilities.yml pattern. On a weekly cron it checks out the canonical spec, inserts any missing feature IDs as not_implemented next to their area.group. siblings, and opens a PR here for triage.

• Runs Mondays 06:00 UTC (and on manual dispatch).
• Uses this repo's own GitHub App credentials (app-id GH_APP_ID / GH_APP_PRIVATE_KEY) to open the PR, so no cross-repo permissions are needed.
• Only adds new IDs as not_implemented; real status and symbols are triaged by a maintainer.

Depends on supabase/sdk#65 merging first (the @main reference resolves once it lands).