fix(scripts): make bring_up_to_date produce minimal, surgical diffs

[sksizer]

Summary

Fixes the issue where `bring_up_to_date` PRs look like entire files are being replaced even when the upstream change was tiny.

Root cause: the previous `scripts/bring_up_to_date/task.md` only said "Apply any new or changed files from the template" without specifying how. Claude was reading template files and rewriting them via the `Write` tool — and any subtle formatting drift (whitespace, trailing newline, EOL) makes git see every line as changed.

Fix: rewrite the prompt to require an explicit upstream clone, byte-for-byte propagation via `cp`, and a post-copy `git diff` verification step:

• Explicitly `git clone` the upstream template into a tempdir as the only source of truth
• For each candidate file, run `diff -u` first; skip if empty
• Default propagation is `cp "$TEMPLATE_DIR/" ./` — guarantees minimal diff
• Surgical `Edit` hunks only when project-specific edits must be preserved
• Forbid `Write` for template-tracked files (this was the actual bug)
• After copying, run `git diff --stat` / `git diff` and verify diffs are minimal; explicit CRLF/whitespace troubleshooting guidance if not
• Exit cleanly with no PR if nothing actually changed

Test plan

• Run `just butd --execute` against a downstream that's slightly behind the template; PR diff should match upstream changes line-for-line
• Run against a fully up-to-date downstream; should exit with "Already up to date" and no PR
• Run against a downstream with intentional local overrides; overrides preserved and listed under "Did not bring over"