ci: gate triage.md staleness against triage.jsonl (#121)

Adds a triage-ledger job running `make triage-check` so a ledger edit that
forgets to regenerate the markdown (make triage-render) fails CI instead of
drifting silently. Stdlib-only, no deps.

.github/workflows/ci.yml

@@ -100,3 +100,14 @@ jobs:
       # registry credentials: this only proves the image builds.
       - name: Build sandbox image (no push)
         run: docker build --pull -t open-swe-sandbox:ci .
+
+  triage-ledger:
+    name: Triage ledger up to date
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      # docs/upstream-sync/triage.md is GENERATED from triage.jsonl. Fail if a
+      # ledger edit forgot to regenerate it (`make triage-render`). Stdlib-only
+      # Python, so no uv sync / deps needed.
+      - name: triage.md is up to date with triage.jsonl
+        run: make triage-check