feat: link and sync external contributor avatars on the organization profile

[kowyo]

Summary

• Link each contributor's existing external GitHub avatar to their profile. GitHub App bots link to their app pages.
• Preserve the original API query, pagination, order, and all 120 contributors, including four bots.
• Sync only the generated README block daily at 02:17 UTC or through manual dispatch. Invalid responses leave the current output intact; identical output produces no commit.
• Use only the Python standard library. The final diff contains three files: the profile README, sync script, and workflow. No generated images, Pillow, dependency installation, documentation, or test files.

Appearance

GitHub renders these external avatars as rounded squares (currently a 6px corner radius), not circles. This change does not store processed images or add an image proxy.

Validation

• 10 private local checks passed, covering external URLs, individual links, order, bots, HTML escaping, failure protection, and repeat-run behavior.
• Live synchronization generated 120 contributors; a second live run reported unchanged. Both runs worked with Python site packages disabled.
• On the final commit, all 120 external avatars loaded in GitHub's README renderer. A profile link and browser Back navigation were verified.
• The workflow only runs on schedule or manual dispatch, so this revision has no PR CI run.

Notes

Generated images were removed with a normal follow-up commit. Earlier draft commits still contain them; a squash merge of the final diff would exclude the images without rewriting branch history.

The sync job uses GITHUB_TOKEN with contents: write, only on this repository's main branch. It never force-pushes or changes branch protection. Maintainers should confirm existing protection rules permit automated commits before merging.