Track upstream branches as pinned releases on an unattended lane

Since publishing moved to CI on merge, a package whose PKGBUILD never
changes while its source moves was never rebuilt: omarchy-dev and
omarchy-settings-dev followed quattro through "#branch=" and a pkgver()
function, and nothing in this repository changed when quattro did. The
host timers that used to notice are off, so edge fell days behind.

The rule now: no git source without a commit or tag pin
(tests/pinned-sources.sh, run in CI). A package that has to follow a
branch declares a git_branch upstream watch, and the pin moves through
the same PR/build/publish path as every other version bump.

Watch (helpers/upstream-watch.py)
  git_branch gains tag_pattern: the newest release tag in the pinned
  commit's own history, exposed as {tag}/{version}/{distance}, so a
  branch build is versioned <tag>.r<n>.g<sha>, above the release it
  follows and below the next one. One blobless clone per branch per
  run, shared by every package on it. min_release_age selects the
  newest commit older than the window, so a push burst builds once.

Lane (helpers/package-metadata.sh, bin/sync-upstream --lane)
  "auto_merge": true moves a package from the reviewed 6-hourly sync
  PR to the unattended lane. Packages pinned from the same branch move
  together: a failure on one restores the others and fails the group,
  so the dev pair can never ship from two quattro commits.

Tracker (.github/workflows/track-branches.yml)
  Every two hours: pin, open one PR with a GitHub App token, enable
  auto-merge. Branch protection still gates the merge on result,
  self-tests and build-isolation. A tip that fails to build stays an
  open red PR until the next tick supersedes it. The App is required:
  a PR opened with GITHUB_TOKEN has its checks held for approval and
  its auto-merge would not fire publish.yml.

The reviewed workflows (sync-upstream, sync-rebuilds) open their PRs
with the same App so their builds start without a maintainer clicking
"Approve workflows to run"; without the App they fall back to
GITHUB_TOKEN and behave as before.

Recipes
  The dev pair pins _commit and a real sha256sum, keeps the OMARCHY_SRC
  override, and drops pkgver(). Its r-number stays the branch's total
  commit count because the published history used it and pacman must
  never see the version go down. omasnap-git is new: omacom/omasnap
  main, versioned <tag>.r<distance>.g<sha>, provides/conflicts omasnap.

pkgbuilds/omarchy-dev/.omarchy/package.json

@@ -1 +1,17 @@
-{ "source": "local", "channels": ["edge"] }
+{
+  "source": "local",
+  "channels": ["edge"],
+  "auto_merge": true,
+  "min_release_age": "30m",
+  "upstream": {
+    "watch": {
+      "git_branch": "https://github.com/basecamp/omarchy.git",
+      "branch": "quattro",
+      "tag_pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)",
+      "version": "{version}.r{count}.g{commit:.7}",
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  }
+}

pkgbuilds/omarchy-dev/PKGBUILD

@@ -1,9 +1,13 @@
 # Maintainer: Ryan Hughes <ryan@omarchy.org>
 pkgname='omarchy-dev'
-pkgver=4.0.0.r847.g4de185b
+pkgver=4.0.0.r6514.gee8ebf6
 pkgrel=1
-_pkgver_base=4.0.0
-_pkgver_base_tag=v3.8.2
+# Pinned by the upstream watch in .omarchy/package.json (bin/sync-upstream):
+# every quattro tip becomes a commit pin here, so the package is versioned,
+# checksummed and built exactly like a release, just more often. The r-number
+# is the branch's total commit count, not the distance from the last tag: the
+# published history used the total, and pacman must never see it go down.
+_commit=ee8ebf615dcbf9e1a126b22a894f907d6795a9a5
 pkgdesc='Beautiful, modern, and opinionated Arch Linux by DHH (quattro branch tip)'
 # The payload is architecture-independent, but the dependency set is not: the
 # boot stack differs per architecture (see depends_x86_64 / depends_aarch64),
@@ -73,30 +77,16 @@ makedepends=(
   'git'
 )
 
-# Source: quattro branch tip by default; set OMARCHY_SRC=/path/to/checkout
-# to build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX).
+# Source: the pinned quattro commit. Set OMARCHY_SRC=/path/to/checkout to
+# build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX);
+# the arrays are emptied below so nothing is downloaded in that case.
+source=("omarchy::git+https://github.com/basecamp/omarchy.git#commit=${_commit}")
+sha256sums=('4f55a96e32143c766f925ec7f721a374c32bd20e66f9a081f5dbe0772c609ecd')
 if [[ -n "${OMARCHY_SRC:-}" ]]; then
   source=()
   sha256sums=()
-else
-  source=("omarchy::git+https://github.com/basecamp/omarchy.git#branch=quattro")
-  sha256sums=('SKIP')
 fi
 
-pkgver() {
-  cd "$srcdir/omarchy"
-
-  local commit_count commit_hash
-  if git rev-parse --verify "${_pkgver_base_tag}^{commit}" >/dev/null 2>&1; then
-    commit_count=$(git rev-list --count "${_pkgver_base_tag}..HEAD")
-  else
-    commit_count=$(git rev-list --count HEAD)
-  fi
-  commit_hash=$(git rev-parse --short=7 HEAD)
-
-  printf "%s.r%s.g%s" "$_pkgver_base" "$commit_count" "$commit_hash"
-}
-
 prepare() {
   if [[ -n "${OMARCHY_SRC:-}" ]]; then
     rm -rf "$srcdir/omarchy"