Keep sync PRs building across bot pushes

Three things kept the upstream sync PR (#589) from ever finishing a build:

Scoped dispatches wiped the shared PR. A workflow_dispatch with `packages`
regenerates only those packages from master, and pushing that to
auto/sync-upstream replaced 38 pending updates with one. Scoped runs now
push to their own auto/sync-{upstream,rebuilds}-<packages> branch and PR;
scheduled runs keep the shared branch.

build-approved stopped working after the first bot push. A GITHUB_TOKEN
push creates pull_request runs held for approval but no pull_request_target
run, so approve-pr.yml never saw it: its last run on the branch was the
label itself (2026-09-25T19:26), and each of the next four syncs sat at
action_required. The sync workflows now release the held runs for the
commit they just pushed, from a separate job holding actions: write, and
only for their own bot-authored, same-repo PR while build-approved is on
it.

Each approved push cancelled the in-flight build. Approving the 21:43
sync's build cancelled the label-triggered one still queued on strata and
schist-bin. On auto/sync-* branches a new build now waits for the running
one instead, then reuses its artifacts. The approval script no longer
waits for a lone approved build to start before releasing tests, which a
queued build would have turned into a timeout.

.github/workflows/sync-upstream.yml

@@ -17,6 +17,12 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    outputs:
+      branch: ${{ steps.branch.outputs.branch }}
+      pushed_at: ${{ steps.pushed.outputs.at }}
+      number: ${{ steps.cpr.outputs.pull-request-number }}
+      operation: ${{ steps.cpr.outputs.pull-request-operation }}
+      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
 
     steps:
       - name: Checkout repository
@@ -24,6 +30,17 @@ jobs:
         with:
           persist-credentials: false
 
+      # A scoped dispatch regenerates only the named packages. Pushed to the
+      # shared branch, that would replace every other pending update in its
+      # PR, so it gets a branch and PR of its own.
+      - name: Choose the PR branch
+        id: branch
+        env:
+          PACKAGES: ${{ github.event.inputs.packages }}
+        run: |
+          read -r -a package_args <<< "${PACKAGES:-}"
+          .github/scripts/sync-pr-branch.sh auto/sync-upstream "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
+
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
@@ -70,13 +87,21 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
+      # Runs created by this push are newer than this; the approve job
+      # waits for them. A minute's slack absorbs runner clock skew.
+      - name: Record push time
+        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
+        id: pushed
+        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Create Pull Request
         if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
+        id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: sync upstream releases'
-          title: 'chore: sync upstream releases'
+          title: "chore: sync upstream releases${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
           body: |
             Automated update of packages that track an upstream vendor release
             feed rather than the AUR.
@@ -84,7 +109,7 @@ jobs:
             Release watches and providers are declared in `.omarchy/package.json`;
             exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
             are left untouched; check the workflow result for outstanding failures.
-          branch: auto/sync-upstream
+          branch: ${{ steps.branch.outputs.branch }}
           delete-branch: true
           labels: automated
           reviewers: ryanrhughes
@@ -100,3 +125,35 @@ jobs:
               "🔴 <strong>Upstream sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
+
+  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
+  # creates no pull_request_target run for it, so approve-pr.yml never sees
+  # the sync's own pushes. Once a maintainer has labelled the PR
+  # build-approved, release the held runs for the commit just pushed. A
+  # separate job, so the sync container's token never holds actions: write.
+  approve:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.operation == 'updated' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Release held build and test runs if build-approved
+        uses: actions/github-script@v7
+        env:
+          NUMBER: ${{ needs.sync.outputs.number }}
+          BRANCH: ${{ needs.sync.outputs.branch }}
+          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
+          SINCE: ${{ needs.sync.outputs.pushed_at }}
+        with:
+          script: |
+            const approve = require('./.github/scripts/approve-sync-push.cjs');
+            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
+            await approve({ github, context, core, number: Number(NUMBER),
+              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });