Track upstream branches as pinned releases on an unattended lane

Since publishing moved to CI on merge, a package whose PKGBUILD never
changes while its source moves was never rebuilt: omarchy-dev and
omarchy-settings-dev followed quattro through "#branch=" and a pkgver()
function, and nothing in this repository changed when quattro did. The
host timers that used to notice are off, so edge fell days behind.

The rule now: no git source without a commit or tag pin
(tests/pinned-sources.sh, run in CI). A package that has to follow a
branch declares a git_branch upstream watch, and the pin moves through
the same PR/build/publish path as every other version bump.

Watch (helpers/upstream-watch.py)
  git_branch gains tag_pattern: the newest release tag in the pinned
  commit's own history, exposed as {tag}/{version}/{distance}, so a
  branch build is versioned <tag>.r<n>.g<sha>, above the release it
  follows and below the next one. One blobless clone per branch per
  run, shared by every package on it. min_release_age selects the
  newest commit older than the window, so a push burst builds once.

Lane (helpers/package-metadata.sh, bin/sync-upstream --lane)
  "auto_merge": true moves a package from the reviewed 6-hourly sync
  PR to the unattended lane. Packages pinned from the same branch move
  together: a failure on one restores the others and fails the group,
  so the dev pair can never ship from two quattro commits.

Tracker (.github/workflows/track-branches.yml)
  Every two hours: pin, open one PR with a GitHub App token, enable
  auto-merge. Branch protection still gates the merge on result,
  self-tests and build-isolation. A tip that fails to build stays an
  open red PR until the next tick supersedes it. The App is required:
  a PR opened with GITHUB_TOKEN has its checks held for approval and
  its auto-merge would not fire publish.yml.

The reviewed workflows (sync-upstream, sync-rebuilds) open their PRs
with the same App so their builds start without a maintainer clicking
"Approve workflows to run"; without the App they fall back to
GITHUB_TOKEN and behave as before.

Recipes
  The dev pair pins _commit and a real sha256sum, keeps the OMARCHY_SRC
  override, and drops pkgver(). Its r-number stays the branch's total
  commit count because the published history used it and pacman must
  never see the version go down. omasnap-git is new: omacom/omasnap
  main, versioned <tag>.r<distance>.g<sha>, provides/conflicts omasnap.

pkgbuilds/omasnap-git/.omarchy/package.json

@@ -0,0 +1,17 @@
+{
+  "source": "local",
+  "channels": ["edge"],
+  "auto_merge": true,
+  "min_release_age": "30m",
+  "upstream": {
+    "watch": {
+      "git_branch": "https://github.com/omacom/omasnap.git",
+      "branch": "main",
+      "tag_pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)",
+      "version": "{version}.r{distance}.g{commit:.7}",
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  }
+}

pkgbuilds/omasnap-git/PKGBUILD

@@ -0,0 +1,72 @@
+# Maintainer: Ryan Hughes <ryan@omarchy.org>
+# The main-branch build of omasnap. Pinned by the upstream watch in
+# .omarchy/package.json (bin/sync-upstream): every main tip becomes a commit
+# pin here, versioned <last tag>.r<commits since>.g<sha> so it sorts above the
+# tagged release it follows and below the next one.
+
+pkgname=omasnap-git
+pkgver=1.21.0.r15.geb22bfe
+pkgrel=1
+_commit=eb22bfe5b79a2235f9bf5a8ffd026bc882969c1e
+pkgdesc="Native Wayland screenshot and annotation overlay for Hyprland (main branch)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/omacom/omasnap"
+license=('MIT' 'OFL-1.1')
+depends=(
+  'hyprland'
+  'layer-shell-qt'
+  'qt6-base'
+  'tesseract'
+  'tesseract-data-eng'
+  'wayland'
+  'wl-clipboard'
+)
+makedepends=(
+  'cmake'
+  'git'
+  'ninja'
+  'pkgconf'
+  'wayland-protocols'
+)
+provides=('omasnap')
+conflicts=('omasnap')
+options=('!debug')
+
+source=("omasnap::git+$url.git#commit=${_commit}")
+sha256sums=('c8717bae97faa3798cce25038d42429185f832cd47b09f20c232f684c721952a')
+
+build() {
+  cmake -S omasnap -B build -G Ninja \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX=/usr
+  cmake --build build --parallel
+}
+
+check() {
+  # The smoke suite fsyncs its working documents under /tmp. On the CI
+  # droplets the build leaves about a gigabyte of dirty pages, and the
+  # flush that starts a few seconds into the suite makes those fsyncs stall
+  # long enough to overrun the suite's 5-second settle windows. Flush first.
+  local runtime_dir status started
+  started=$(date +%s%N); sync
+  echo "flushed dirty pages in $(( ($(date +%s%N) - started) / 1000000 )) ms"
+  runtime_dir=$(mktemp -d /dev/shm/omasnap-runtime.XXXXXX)
+  if QT_QPA_PLATFORM=offscreen QT_FORCE_STDERR_LOGGING=1 \
+    XDG_RUNTIME_DIR="$runtime_dir" \
+    ./build/omasnap-smoke "$srcdir/omasnap-smoke-output"; then
+    status=0
+  else
+    status=$?
+    echo "omasnap-smoke exited with status $status" >&2
+  fi
+  rm -r -- "$runtime_dir"
+  return "$status"
+}
+
+package() {
+  cmake --install build --prefix "$pkgdir/usr"
+  install -Dm644 omasnap/README.md \
+    "$pkgdir/usr/share/doc/omasnap/README.md"
+  install -Dm644 omasnap/LICENSE \
+    "$pkgdir/usr/share/licenses/omasnap/LICENSE"
+}