[roachadam]

Adds PATCHES.md, the record of what this fork carries on top of refraction-networking/utls and how it stays in sync.

Patch table: one row per fork commit (module path, the five uTLS fixes, removal of the Go build workflow) with its source and the reason we carry it.

Syncing with upstream: how the weekly job from #7 works and what it expects from you:

• review the upstream compare link and go.mod changes in each sync PR
• merge sync PRs with Create a merge commit
• an open sync PR is never updated; merge or close it to get a newer one
• keep fork changes in ordinary commits (changes made only in a merge commit are dropped)
• resolving a cherry-pick conflict locally with --continue
• upstream workflow-file changes must be synced by hand

Safeguards: read-only build job, bundle hash check, sync-merge check on main, spoof-proof marker search, ruleset on main with no bypass, SHA-pinned actions, and what happens if Actions may not create PRs.

Documentation only; no code changes.