Auto-merge rebuild PRs once their builds pass (#862)

sync-rebuilds now runs on the unattended lane like track-branches: it
opens the pkgrel bump PR with PKGS_BOT_TOKEN and enables auto-merge, so a
Qt (or any rebuild_on) update reaches users without a maintainer merge.
Branch protection still requires result, self-tests and build-isolation
to pass; a failed rebuild stays an open red PR.

The PAT is required because a GITHUB_TOKEN merge does not start
publish.yml. PAT pushes are not held for approval, so the approve job,
the build-approved label and the review request go away.

Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

tests/pr-workflow-approval.cjs

@@ -435,7 +435,7 @@ test('scoped branch names reject anything that is not a package name', () => {
 });
 
 test('sync workflows push scoped runs aside and keep actions: write out of the sync job', () => {
-  for (const file of ['sync-upstream.yml', 'sync-rebuilds.yml']) {
+  for (const file of ['sync-upstream.yml']) {
     const text = readFileSync(join(__dirname, '../.github/workflows', file), 'utf8');
     const sync = text.slice(text.indexOf('\n  sync:\n'), text.indexOf('\n  approve:\n'));
     const approveJob = text.slice(text.indexOf('\n  approve:\n'));
@@ -450,3 +450,17 @@ test('sync workflows push scoped runs aside and keep actions: write out of the s
     assert.match(approveJob, /needs\.sync\.outputs\.operation == 'updated'/, file);
   }
 });
+
+test('rebuild sync opens its PR with the bot token and auto-merges it', () => {
+  const file = 'sync-rebuilds.yml';
+  const text = readFileSync(join(__dirname, '../.github/workflows', file), 'utf8');
+  assert.match(text, /sync-pr-branch\.sh auto\/sync-rebuilds "\$\{package_args\[@\]\}"/, file);
+  assert.match(text, /branch: \$\{\{ steps\.branch\.outputs\.branch \}\}/, file);
+  // A GITHUB_TOKEN merge would not start publish.yml, so the PR and the
+  // merge both go through the PAT.
+  assert.match(text, /token: \$\{\{ secrets\.PKGS_BOT_TOKEN \}\}/, file);
+  assert.doesNotMatch(text, /secrets\.GITHUB_TOKEN/, file);
+  assert.match(text, /gh pr merge --auto --merge "\$PR"/, file);
+  assert.doesNotMatch(text, /^ +actions: write$/m, file);
+  assert.doesNotMatch(text, /\n  approve:\n/, file);
+});