Nightly sync of MailForge unsubscribes into HubSpot

Build me a scheduled code workflow that syncs my MailForge suppression list into HubSpot every night so anyone who unsubscribed or bounced in MailForge is also flagged as email opted-out in the CRM. This is a deterministic pipeline with no reasoning steps — fetch, iterate, look up, update — so please build it as a code workflow.

Trigger: cron, daily at 02:00 in the workspace timezone.

Steps:

1) Call the MailForge List Suppressions operation and page through every suppressed email address. Use per_page=100 and keep advancing page until the response indicates there are no more pages. Collect the full list of suppressed emails (with their reason and suppressed-at timestamp if available).

2) For each suppressed email, call the HubSpot Search Contacts operation filtered by that email address to find the matching CRM record. If no contact is returned, skip silently and continue. If a contact is returned, read its current email opt-out property.

3) If the contact's opt-out flag is already true, short-circuit and move on (do not call Update Contact). If it is not already set, call the HubSpot Update Contact operation for that contact id and set the email opt-out property (default to hs_email_optout, but let me pick a different property name at setup time) to true. Also stamp a last-synced timestamp property (default name mailforge_suppression_last_synced_at) with the current ISO-8601 datetime.

4) At the end of the run, log a compact summary: total suppressions fetched, contacts matched in HubSpot, contacts newly opted out, contacts already opted out and skipped, and emails with no HubSpot match.

Requirements: the run must be idempotent (rerunning the same day should be a no-op after the first successful pass). Respect HubSpot's Search API rate limit of 4 requests per second; add gentle spacing between search calls. On HTTP 429 from HubSpot, honor the Retry-After header. Do not create new HubSpot contacts under any circumstances — this workflow only updates records that already exist.

Connections I will provide: MailForge (API key + instance URL) and HubSpot (OAuth with crm.objects.contacts.read and crm.objects.contacts.write).