chore(brand): sync sync-brand-numbers.mjs from blockrun

[VickyXAI]

Vendored copy of brand/sync-brand-numbers.mjs from BlockRunAI/blockrun.

blockrun's ci.yml runs brand-script-sync, which compares every consumer's copy against the canonical one and fails on drift. This PR must land before BlockRunAI/blockrun#469, which carries the canonical change and is red until the consumers update.

Four fixes in this build:

• Markers inside fenced code blocks were skipped by the rewriter and by --check, so a number in an ASCII diagram went stale under a green build. They can now opt in with @live, and any fenced marker whose value actually disagrees with the artifact is reported (non-fatal).
• Fence ranges were measured once against the original text but tested against the accumulating result. A badge expands 2 characters into ~150, so every later fence test read the wrong bytes. Recomputed per marker.
• An unterminated fence was dropped rather than closed at EOF, silently treating the rest of the file as live prose.
• Only git-tracked files are rewritten was in the header but nothing implemented it. Now filtered through git ls-files, falling back to the full walk outside a git checkout.

No change to this repo's numbers — script only. Opened by a propagation run, not hand-edited.

[VickyXAI]

Pushed 62e1793 — this PR would have broken installs of @blockrun/xclawrouter without it.

The synced 360-line script imports node:child_process (it shells out to git ls-files to honour its own "only git-tracked files are rewritten" contract). This repo's package.json files includes "scripts", so it would have shipped in the tarball, and OpenClaw's plugin scanner blocks the install of any package containing a loose script with a dangerous code pattern — installation blocked: Shell command execution detected.

That is the exact failure that made @blockrun/clawrouter v0.12.222 uninstallable. ClawRouter carries the same "!scripts/sync-brand-numbers.mjs" exclusion for the same reason.

Verified against the real pack list rather than intent:

before:  npm pack --dry-run | grep sync-brand-numbers  →  1
after:   npm pack --dry-run | grep sync-brand-numbers  →  0

Also checked the rest of the shipped set: the only other loose script that ships is scripts/e2e-multiturn.mjs, and it does not import child_process. So this repo is clean after the one line.

Follow-up worth doing separately: this repo has no build-time guard for it. ClawRouter's scripts/smoke-dist.mjs runs as postbuild and asserts on npm pack --dry-run --json, failing the build if any shipped scripts/*.{mjs,js,cjs} imports child_process — that is what caught this class in ClawRouter before publish. XClawRouter's build is bare tsup with no postbuild, so a future edit that drops the files entry would go unnoticed until the next uninstallable release. Not adding it here to keep this PR to one line.