ci: replicate source snapshots

[leandrodamascena]

Issue #, if available:

N/A

Description of changes:

• add an hourly and manually dispatched source replication workflow
• archive the exact triggering master commit using git archive
• verify that the tracked-only snapshot matches its SHA-256 checksum
• upload the snapshot with checksum metadata and require an S3 version ID
• rely on the existing S3 object-created event to trigger replication
• use pinned action SHAs, minimal permissions, serialized execution, and a dedicated replication environment

Before merge, configure the replication environment for the master branch with these secrets:

• REPLICATION_ROLE_ARN
• REPLICATION_BUCKET_NAME

Validation performed:

• parsed the workflow as YAML
• syntax-checked every shell block with bash -n
• verified the source archive checksum and absence of .git entries
• scanned the complete diff for credentials and internal identifiers

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[leandrodamascena]

Hey @maxday can you review this PR please?