Let sync PRs approve their own builds

The upstream and rebuild syncs push with GITHUB_TOKEN, so GitHub holds
their build and test runs for approval. Their approve job only released
those runs once a maintainer had applied build-approved, and never ran
for the push that opened the PR, so every sync PR sat waiting.

The sync now labels its own PR build-approved, and the approve job runs
for created PRs as well as updated ones.

README.md

@@ -914,11 +914,11 @@ build artifacts.
 
 Sync PRs are pushed with `GITHUB_TOKEN`, so GitHub holds their build and test
 runs for approval on every push and starts no `pull_request_target` workflow
-for them. Once **`build-approved`** is on a sync PR, the sync workflow's own
-`approve` job releases the held runs for each commit it pushes. A push to an
-`auto/sync-*` branch does not cancel the PR's in-flight build: the new build
-waits for it and then reuses its artifacts, so a long aarch64 build is not
-restarted by every sync.
+for them. The sync workflows label their own PRs **`build-approved`**, and
+their `approve` job releases the held runs for each commit they push, including
+the push that opens the PR. A push to an `auto/sync-*` branch does not cancel
+the PR's in-flight build: the new build waits for it and then reuses its
+artifacts, so a long aarch64 build is not restarted by every sync.
 
 To approve builds for an unvouched contributor's PR, apply **`build-approved`**.
 Until approval, the PR shows **Awaiting build approval** and its required