[ivangrynenko]

Moves the Sentinel upgrade scan here from truecms/sentinel-upgrade-scan (truecms/sentinel#2014), so future Sentinel CI actions can live in one public repository.

What changed

• upgrade-scan/: the scan script, the GitHub action (action.yml) and the GitLab template (gitlab.yml, pinned to a tag and the script's SHA-256).
• upgrade-scan/examples/: a GitHub workflow and a GitLab job to copy.
• upgrade-scan/prompts/add-upgrade-scan.md: a prompt for an AI coding assistant to add the scan to a repository. It keeps the scan key out of files and chat.
• scripts/pin-release.sh pins every */gitlab.yml to a release tag.
• Fixes from review since the old repository: only custom code is scanned (--ignore-contrib), the scan key is kept off command lines, the site UUID is sent in lower case, the scan refuses to start without a module list, and the installed packages are put back with the same dev setting after the scan.

Access and exposure

Question	Answer
Who may reach it?	Anyone can read this public repository. The scan only talks to Sentinel with a site's scan key.
What stops everyone else?	Sentinel refuses a wrong key (401) and answers 404 while the scan route is closed.
Is it released?	Sentinel keeps the route closed until UPGRADE_SCAN_ENABLED and the readiness rollout allow it.
What does it reveal?	Nothing secret. The key goes to curl in a 0600 header file and to Drush through the environment, never on a command line.
How is it tested?	Bats tests cover a refused key, a closed route, bad inputs and every problem reason.

Checks run

• bats tests/upgrade-scan/scan.bats: 53 passed.
• shellcheck on the script and stubs: clean.
• Codex review (GPT-6.1 Terra, xhigh): findings fixed.