feat: auto-source config metadata and simplify CI check mapping

[onlyarnav]

Summary

• Auto-source stable fields: Derive upstream_repo, upstream_default_branch, product_family_url, topics/labels, and mailing lists (dev_list, commits_list, users_list, private_list, security_list, announce_list) from .asf.yaml and repository metadata via gh repo view, minimizing configuration duplication.
• Simplify and optionalize CI map: Make pr-management-triage-ci-check-map.md optional and collapse its default template table to a single catch-all pointer (upstream_contributing_docs_url), simplifying the setup and reducing maintenance burden.
• Drift detection and reconciliation: Added verification and upgrade steps to detect when auto-sourced fields have drifted from .asf.yaml or repository metadata, allowing in-place reconciliation.

Type of change

• Skill change (.claude/skills/<name>/) — setup (adopt, upgrade, verify) and pr-management-triage skills updated.
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes (115 tests passed in tools/skill-evals/tests/)
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
• For skill behaviour changes: a new or updated eval fixture is included in this PR
• Other: Ran prek run doctoc --all-files to verify TOC generation (passed). Manually ran license header verification tools/dev/add-license-headers.py on all changed files (passed).

RFC-AI-0004 compliance

• HITL — any new mutation (drift updates during upgrade) is gated on explicit user confirmation.
• Sandbox — no new unrestricted host access.
• Vendor neutrality — placeholders (<PROJECT>, <tracker>, <upstream>, <security-list>) used in all modified files.
• Conversational + correctable — agentic-override behavior for triage mapping is preserved and documented.
• Write-access discipline — no autonomous outbound messages.
• Privacy LLM — no private content sent to the LLM.

Linked issues

#815

Notes for reviewers (optional)

The prek run --all-files command hit compilation issues locally due to missing MSVC cargo compiler dependency (lychee link checker compilation error) and python shell alias on the Windows testing host. Formatting and licence headers were verified manually and through individual prek hooks (doctoc), all passing successfully.

[potiuk]

Nice one ! Thanks @onlyarnav !

[potiuk]

I will add one thing though as a fix-up to make the .asf.yaml only used for ASF projects.