Bug: The sync mechanism must ensure that a header comment is present on all sync'd material indicating the source and that it is not to be edited locally

[trevor-vaughan]

Prerequisites

• I have searched for existing issues
• This is not a security vulnerability (report via the repository's SECURITY.md)

Describe the bug

When scanners, such as zizmor and actionlint, scan for issues in a repository, it must be obvious as to whether or not a file is injected by org-infra.

Without this, updates will be made that require undocumented understanding of the structure of the system and make it difficult for agentic updates to succeed correctly.

Example: complytime/complyctl#710 (review)

To Reproduce

1. Have lint errors
2. Fix lint errors
3. Watch your fixes be overwritten at the next sync

Expected behavior

Both humans and LLMs understand where issues should be resolved at all times without needing to understand any non-obvious context.

Screenshots

Related: #256

Environment

No response

Additional context

No response

[marcusburghardt]

You can also propose a minor update to CONTRIBUTING.md files to make this clear even before new contributors start proposing changes to specific files.