feat(scripts): add template_review for surfacing backport candidates

[sksizer]

Summary

• New read-only review tool that scans each downstream project for shared-infrastructure changes worth bringing back into the template.
• `scripts/template_review.sh` runs Claude (tools restricted to `Read Bash`) against a downstream clone, diffing shared files (`.github/`, `justfile`, `scripts/`, configs, etc.) against `$TEMPLATE_DIR` and producing a structured markdown report classifying each hunk as BACKPORT, PROJECT-SPECIFIC, DRIFT, or TEMPLATE-NEWER.
• `scripts/template_review_all.sh` parallelizes the review across every repo in `downstream.txt`, prints per-repo reports under banners, and writes an aggregated `REVIEW.md`. Clones are intentionally left on disk so candidates can be inspected manually.
• Project-specific files (`Cargo.toml`, `src/`, `README.md`, `LICENSE.md`, `scripts/downstream.txt`) are explicitly excluded from review.
• `justfile`: adds `template-review` (`tr`) and `template-review-all` (`tra`).

Test plan

• `just tr` (dry run) prints the composed prompt
• `just tr --execute path/to/local/downstream` produces a markdown report and makes no file/git mutations
• `just tra --execute` runs in parallel and aggregates per-repo reports