Auto-merge upstream updates for trusted packages (#892)

* Auto-merge upstream updates for trusted packages

The unattended lane already runs every upstream provider, not only branch
watches, so trusted release feeds can ship without waiting on the reviewed
sync PR. Opt in the browsers, large vendors' apps, Omacom's own projects,
and the vendor binaries that hold fresh releases for 24h: 39 packages,
including rawmakase-bin and gliff.

Drivers, firmware, the bootloader, core desktop components, beta and
nightly channels, and community projects stay on the reviewed lane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Auto-merge grok-bot, perplexity, disktree-bin, cliamp, openclaw, voxtype-bin and ttfx

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/track-branches.yml

@@ -1,9 +1,11 @@
 name: Track upstream branches
 
-# The unattended lane. Packages marked "auto_merge": true follow a moving
-# upstream branch (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git
-# on main) rather than tagged releases, so nothing in this repository changes
-# when their source does. This workflow makes each new branch tip a commit pin
+# The unattended lane. Packages marked "auto_merge": true update without a
+# human: some follow a moving upstream branch (omarchy-dev and
+# omarchy-settings-dev on quattro, omasnap-git on main) rather than tagged
+# releases, so nothing in this repository changes when their source does;
+# the rest are release feeds trusted to ship unreviewed (browsers, large
+# vendors, Omacom's own projects). This workflow makes each new branch tip a commit pin
 # in the recipe, which publish.yml then treats like any other version bump:
 # the PR builds on the droplets, auto-merge lands it when `result` is green,
 # and the merge publishes the artifacts. A tip that fails to build stays an
@@ -121,10 +123,11 @@ jobs:
           commit-message: ${{ steps.describe.outputs.title }}
           title: ${{ steps.describe.outputs.title }}
           body: |
-            Automated pin of packages that follow a moving upstream branch
-            (`"auto_merge": true` in `.omarchy/package.json`). Each package's
-            `_commit` now points at the branch tip. Fresh tips wait until
-            their commit timestamp is at least `min_release_age` old.
+            Automated update of packages on the unattended lane
+            (`"auto_merge": true` in `.omarchy/package.json`). Branch-tracking
+            packages now pin their branch tip; release-feed packages move to
+            their newest upstream release. Fresh releases and tips wait until
+            they are at least `min_release_age` old.
 
             This PR auto-merges once the build checks pass. A failing build
             leaves it open; the next tracker run replaces it with the newer tip.