Auto-merge upstream updates for trusted packages (#892)

* Auto-merge upstream updates for trusted packages

The unattended lane already runs every upstream provider, not only branch
watches, so trusted release feeds can ship without waiting on the reviewed
sync PR. Opt in the browsers, large vendors' apps, Omacom's own projects,
and the vendor binaries that hold fresh releases for 24h: 39 packages,
including rawmakase-bin and gliff.

Drivers, firmware, the bootloader, core desktop components, beta and
nightly channels, and community projects stay on the reviewed lane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Auto-merge grok-bot, perplexity, disktree-bin, cliamp, openclaw, voxtype-bin and ttfx

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

helpers/package-metadata.sh

@@ -333,7 +333,8 @@ packages_for_upstream_sync() {
 # "auto_merge": true rides the unattended lane instead: its bump PR is opened
 # and auto-merged by the branch tracker as soon as CI is green, which is how a
 # package that follows a moving branch (omarchy-dev, omasnap-git) gets rebuilt
-# without anyone clicking. The lanes are disjoint so a branch tip can never
+# without anyone clicking, and how trusted release feeds (browsers, large
+# vendors, Omacom's own projects) ship without waiting for review. The lanes are disjoint so a branch tip can never
 # hold up a reviewed vendor release, or the other way round.
 package_auto_merge() {
   local pkgdir="$1" metadata