address weaknesses #310
Description
CI automation now uses rhiza sync. .github/workflows/rhiza_sync.yml was migrated from the deprecated uvx "rhiza>=${RHIZA_VERSION}" materialize --force . to uvx "rhiza>=${RHIZA_VERSION}" sync. The renovate_rhiza_sync.yml was already using sync. Both automation workflows now use the current API with lock-file tracking and 3-way merge.
No template.lock validation in CI. While rhiza_validate.yml exists and runs rhiza validate on template.yml, there is no workflow that verifies the lock file is current or that rhiza sync runs successfully in CI. This would catch regressions in the sync mechanism automatically.