Automate vendored patch proof with site-specific ledger (CL-5720)

[TheGreatAxios]

Summary

• bin/vendor-patch-diff diffs vendor/ against a pristine upstream checkout at the SHA in docs/VENDORING.md (authoritative proof of our lines).
• Site-specific PATCHES.md anchors + matching Locally patched markers.
• Correspondence test enforces marker↔ledger.
• VENDORING.md documents the script as the re-sync procedure.

Closes CL-5720

Test plan

• bun test tests/unit/vendor-patch-ledger.test.ts
• CI green

[linear-code]

CL-5720