Automate Grok Bot releases (#583)

* Automate Grok Bot releases

* Refresh Grok Bot to apt 0.66.0 and harden upstream.sh

Bump both architectures to Cursor apt 0.66.0 with matching SHA256s,
introduce a versioned _pool URL helper, and filter Packages stanzas by
Package: grok-bot so sync stays correct if the index grows.

* grok-bot: bump to 0.68.1, drop manual hold, validate pool filename

Bump both architectures to Cursor apt 0.68.1 with the SHA256s from the
amd64/arm64 Packages indexes (verified against the downloaded debs).

Drop grok-bot from the manual holds list in docs/upstream-sources.md and
have upstream.sh check that the newest stanza's Filename is the versioned
pool path the PKGBUILD downloads from. Both additions come from #848.

pkgbuilds/grok-bot/.omarchy/package.json

@@ -1,6 +1,6 @@
 {
   "source": "local",
-  "sync": false,
+  "release_ring": "fast",
   "origin": {
     "aur": "grok-bot",
     "commit": "05eb78fca06b482affda28b26223cbf249d4bbcd"