chore(ci): remove dropped workflows again after upstream merges

Port the v1 merge tooling `skipFiles` behavior for workflows:
`bun script/check-workflows.ts --fix` runs `git rm -f` on the upstream
workflows that Kilo removed, which also resolves their modify/delete
conflicts. A new upstream workflow still fails the check for review.

Add the step to the v2 upstream merge procedure in the fork conventions.

script/check-workflows.ts

@@ -2,22 +2,29 @@
 // kilocode_change - new file
 
 /**
- * Guards against accidentally inheriting workflows from upstream OpenCode.
+ * Keeps upstream OpenCode workflows out of Kilo CI.
  *
- * The Kilo v2 line merges `upstream/v2` regularly. When upstream adds a workflow under
- * `.github/workflows/`, or a merge brings back one that Kilo removed, it silently starts to run in
- * Kilo's CI. Upstream workflows can publish, deploy, post, label or close things. This check makes
- * that decision explicit: the allowed workflows are listed below, and any drift (an added or a
- * removed file) fails CI until the list is updated deliberately.
+ * The Kilo v2 line merges `upstream/v2` regularly. Upstream workflows can publish, deploy, post, label or
+ * close things, and a merge can bring them back: a new upstream workflow arrives as a new file, and an
+ * upstream change to a workflow that Kilo removed arrives as a modify/delete conflict.
  *
- * To accept a new workflow: review what it does, then add its filename to `active`.
- * To drop one: delete the file and remove its filename from `active`.
+ * Check (CI): `bun script/check-workflows.ts` fails when `.github/workflows/` differs from `active`.
+ *
+ * Fix (after an upstream merge): `bun script/check-workflows.ts --fix` runs `git rm -f` on every workflow in
+ * `removed` that the merge brought back, which also resolves its modify/delete conflict. This is the v2 form
+ * of the v1 merge tooling `skipFiles` list (`script/upstream/utils/config.ts` on `main`). A workflow that is
+ * in neither list still fails the check, so a person reviews it.
+ *
+ * To accept a workflow: review what it does, then add its filename to `active`.
+ * To drop an upstream workflow: delete the file and move its filename to `removed`.
  */
 
+import { $ } from "bun"
 import { readdirSync } from "node:fs"
 import path from "node:path"
 
-const DIR = path.resolve(import.meta.dir, "..", ".github", "workflows")
+const ROOT = path.resolve(import.meta.dir, "..")
+const DIR = path.join(ROOT, ".github", "workflows")
 
 // Workflows deliberately accepted into Kilo CI. Sort alphabetically.
 const active = new Set([
@@ -29,13 +36,55 @@ const active = new Set([
   "test.yml",
 ])
 
-// GitHub runs both .yml and .yaml files in .github/workflows/, so both count as drift.
-const actual = new Set(readdirSync(DIR).filter((file) => file.endsWith(".yml") || file.endsWith(".yaml")))
+// Upstream workflows that Kilo removed: they act outside Kilo CI, or they never trigger on Kilo branches.
+// Sort alphabetically.
+const removed = new Set([
+  "close-issues.yml",
+  "close-prs.yml",
+  "compliance-close.yml",
+  "containers.yml",
+  "deploy-files.yml",
+  "deploy-posts.yml",
+  "deploy-www.yml",
+  "deploy.yml",
+  "docs-locale-sync.yml",
+  "docs-update.yml",
+  "duplicate-issues.yml",
+  "nix-eval.yml",
+  "nix-hashes.yml",
+  "notify-discord.yml",
+  "opencode.yml",
+  "pr-management.yml",
+  "pr-standards.yml",
+  "publish-github-action.yml",
+  "publish-vscode.yml",
+  "publish.yml",
+  "release-github-action.yml",
+  "review.yml",
+  "stats.yml",
+  "storybook.yml",
+  "triage.yml",
+])
 
+// GitHub runs both .yml and .yaml files in .github/workflows/, so both count as drift.
+const workflows = () => readdirSync(DIR).filter((file) => file.endsWith(".yml") || file.endsWith(".yaml"))
+
+if (process.argv.includes("--fix")) {
+  for (const file of workflows().filter((file) => removed.has(file))) {
+    await $`git rm -f --quiet ${path.join(".github", "workflows", file)}`.cwd(ROOT)
+    console.log(`check-workflows: removed ${file}`)
+  }
+}
+
+const actual = new Set(workflows())
 const errors = [
   ...[...actual]
     .filter((file) => !active.has(file))
-    .map((file) => `unexpected workflow: ${file}. If it was added intentionally, add it to script/check-workflows.ts`),
+    .map((file) =>
+      removed.has(file)
+        ? `removed upstream workflow is back: ${file}. Run \`bun script/check-workflows.ts --fix\``
+        : `unexpected workflow: ${file}. Review it, then add it to \`active\` or \`removed\` in script/check-workflows.ts`,
+    ),
   ...[...active]
     .filter((file) => !actual.has(file))
     .map(