Keep branch syncs together and simplify tracker setup

.github/workflows/sync-upstream.yml

@@ -72,30 +72,11 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
-      # A PR opened with GITHUB_TOKEN gets its build and test runs held
-      # until a maintainer clicks "Approve workflows to run"; one opened by
-      # the App builds on its own, so the reviewer sees a green (or red) PR
-      # instead of a pending one. The App only opens the PR: merging stays
-      # a human decision in this lane.
-      - name: Mint the bot token
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: app
-        env:
-          PKGS_BOT_APP_ID: ${{ secrets.PKGS_BOT_APP_ID }}
-        # Without the App configured this falls back to GITHUB_TOKEN below,
-        # which still opens the PR; a maintainer then has to approve its
-        # workflow runs by hand, as before.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.PKGS_BOT_APP_ID }}
-          private-key: ${{ secrets.PKGS_BOT_PRIVATE_KEY }}
-        continue-on-error: true
-
       - name: Create Pull Request
         if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ steps.app.outputs.token || secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: sync upstream releases'
           title: 'chore: sync upstream releases'
           body: |