Replace scheduled AUR imports with direct upstream watches

.github/workflows/sync-upstream.yml

@@ -27,9 +27,11 @@ jobs:
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
+        id: sync
         run: |
           docker run --rm \
             -e PACKAGES="$PACKAGES" \
+            -e UPSTREAM_GITHUB_TOKEN="$UPSTREAM_GITHUB_TOKEN" \
             -e HOST_UID="$(id -u)" \
             -e HOST_GID="$(id -g)" \
             -v "$PWD/bin:/workspace/bin:ro" \
@@ -39,7 +41,7 @@ jobs:
             archlinux:base-devel bash -lc '
               set -euo pipefail
 
-              pacman -Syu --noconfirm git jq
+              pacman -Syu --noconfirm git jq python libarchive
 
               groupadd -g "$HOST_GID" runner
               useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
@@ -54,8 +56,12 @@ jobs:
             '
         env:
           PACKAGES: ${{ github.event.inputs.packages }}
+          UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Failed feeds leave their recipes untouched; completed updates still
+      # reach review. The failed sync step keeps the workflow red and notifies.
       - name: Check for changes
+        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
         id: changes
         run: |
           if [ -z "$(git status --porcelain)" ]; then
@@ -65,7 +71,7 @@ jobs:
           fi
 
       - name: Create Pull Request
-        if: steps.changes.outputs.has_changes == 'true'
+        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -75,8 +81,9 @@ jobs:
             Automated update of packages that track an upstream vendor release
             feed rather than the AUR.
 
-            Each package reports its newest release through
-            `.omarchy/upstream.sh`.
+            Release watches and providers are declared in `.omarchy/package.json`;
+            exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
+            are left untouched; check the workflow result for outstanding failures.
           branch: auto/sync-upstream
           delete-branch: true
           labels: automated