The upstream and rebuild syncs push with GITHUB_TOKEN, so GitHub holds their build and test runs for approval. Their approve job only released those runs once a maintainer had applied build-approved, and never ran for the push that opened the PR, so every sync PR sat waiting. The sync now labels its own PR build-approved, and the approve job runs for created PRs as well as updated ones.