Add gatekeeper-salesforce with corrected sync pipeline

[remi-tl]

Summary

• Adds the new packages/gatekeeper-salesforce Worker (JWT SF auth, D1 store, Vectorize embeds, sync workflow) plus release-manifest wiring for D1, Vectorize, AI, and Workflows bindings.
• Includes P0/P1 sync correctness fixes: getDeleted handling, no SOQL LIMIT cap, nextRecordsUrl pagination, coordinated D1 + Vectorize deletes, nested/related field embeds, and cursor tie-break for stable incremental sync.
• Fixture bundle + golden manifest updates so deploy-side packaging recognizes the package.

Test plan

• pnpm test in packages/gatekeeper-salesforce — 24/24 passed
• pnpm types:check — clean
• node --test scripts/release-manifest.test.js — 4/4 passed
• Ops deploy still required: provision D1 + Vectorize, set SF_CLIENT_ID / SF_USERNAME / SF_PRIVATE_KEY (and optional SF_LOGIN_URL), run migrations, kick first sync

Made with Cursor

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}