feat(scripts): add template_backport to auto-PR improvements into template

[sksizer]

Summary

• New write-capable companion to `template_review`: harvests high-confidence generalizable improvements from a downstream project and opens a PR back to the template.
• `scripts/template_backport.sh` clones the template fresh into a tempdir (user's working copy is never touched), exports `DOWNSTREAM_DIR` + `DOWNSTREAM_NAME`, then runs Claude with `Read Edit Write Bash` to:
  1. Diff shared infrastructure against the downstream
  2. Classify each hunk conservatively as BACKPORT or SKIP (checks downstream `git log` for intent)
  3. Apply BACKPORT hunks, run `just full-check`, revert anything that fails
  4. Branch, commit, push, and open a PR via `gh` — one PR per downstream
• Hard-excludes project-specific files (`Cargo.toml`, `src/`, `README.md`, `LICENSE.md`, `scripts/downstream.txt`).
• If zero candidates survive classification or checks, exits cleanly with no PR.
• `scripts/template_backport_all.sh` fans the above out over `downstream.txt` in parallel.
• `justfile`: adds `template-backport` (`tb`) and `template-backport-all` (`tba`).

Test plan

• `just tb path/to/downstream` (dry run) prints composed prompt
• `just tb --execute path/to/downstream` clones the template into a tempdir, applies only safe changes, and either opens a PR or reports "no candidates"
• `just tba --execute` runs across all downstream repos and opens one PR each where applicable
• Verify working copy of the template repo is never modified during `--execute` runs