docs(privacy): PR-time sync check (replaces broken push-based auto-render)

[yasirhamza]

Followup to #164. The `render-privacy-worker.yml` workflow it introduced tried to `git push` directly to `main` after rendering, which the repo ruleset blocks ("Changes must be made through a pull request"). Same pattern would have hit the site repo's workflow. I switched to Option C from the plan revision: drop the push-based auto-render and add a PR-time sync check.

Summary

• Renders `cloudflare-worker.js` from current markdown (catch-up commit so main is in sync — I deployed the rendered Worker via Cloudflare API after docs(privacy): single-source-of-truth pipeline + content refresh #164 merged, but the repo file never got updated because the workflow push failed)
• Deletes `.github/workflows/render-privacy-worker.yml` and `.github/workflows/notify-privacy-sync.yml` (both attempted to push to main directly)
• Adds `.github/workflows/check-privacy-sync.yml` — a PR-time check that renders to a temp file and diffs against the committed `cloudflare-worker.js`. Fails with a clear message telling the contributor to run the render locally

Contributor workflow after this change

When editing `docs/PRIVACY_POLICY.md`:

```bash
python3 scripts/render_privacy.py docs/PRIVACY_POLICY.md cloudflare-worker.js
```

Commit both files together. If you forget, CI fails with the exact command to run. After merge, run `wrangler deploy` (or equivalent — I used the Cloudflare API directly) to push the updated Worker live.

What this PR does NOT address

• The `androdr-site` repo's `render-privacy.yml` workflow in PR build(deps): bump gradle-wrapper from 8.7 to 9.4.1 #1 has the same push-to-main issue. I'll update that PR separately with the same pattern (commit rendered `index.html` + CI sync check).
• Adding the privacy-sync step to `CONTRIBUTING.md` — PR docs: documentation sweep (ARCHITECTURE + README + CONTRIBUTING + CLAUDE + cleanups) #166 (docs sweep) rewrites that file; I'll add the step there.

Test plan

• CI `build` + `lint-and-detekt` pass
• New `check-privacy-sync` job runs on this PR and passes (cloudflare-worker.js was just rendered from the current markdown, so no drift)
• After merge, any future whitespace-only edit to `docs/PRIVACY_POLICY.md` without a matching re-render will fail `check-privacy-sync`
• Zero lingering references to the deleted workflows in other files

🤖 Generated with Claude Code