chore: allow the static-site sync in the bot file policy (#407)

## Summary

The static-site sync PR (#406) is blocked by `Check Bot Policies`:
`.github/repo_policies/BOT_APPROVED_FILES` has no entry for what
`sync-static-site.yml` stages.

- **`sync-static-site`**: adds `.sources/upstream.json` (the pin bump)
and `docs/guides/frontends/static-site/*` (the synced pages).
- **`update-syntax-grammars`**: the workflow stages `syntaxes/`
wholesale, but only two of the three files in it were listed, so a new
grammar would block the next PR. Replaced with `syntaxes/*`.

Verified every path each bot workflow stages against the fnmatch
patterns: all covered.

The checker reads this file from the default branch, not from the PR
head, so #406 stays blocked until this merges. Re-run its failed job
afterwards.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: marc0olo

.github/repo_policies/BOT_APPROVED_FILES

@@ -1,4 +1,6 @@
 # Files the pr-automation-bot-public bot is allowed to change via automated PRs.
+# Each block covers what its workflow stages. Patterns are fnmatch, where `*`
+# also matches `/`, so a directory entry covers nested paths.
 
 # sync-motoko: bumps the Motoko submodule and syncs generated docs
 .sources/motoko
@@ -11,6 +13,9 @@ docs/references/internet-identity-spec.md
 docs/references/verifiable-credentials-spec.md
 public/references/internet-identity.did
 
+# sync-static-site: bumps the certified-assets pin and syncs the static-site pages
+.sources/upstream.json
+docs/guides/frontends/static-site/*
+
 # update-syntax-grammars: updates TextMate grammars from vscode-motoko releases
-syntaxes/motoko.tmLanguage.json
-syntaxes/candid.tmLanguage.json
+syntaxes/*