Open one auto-merging PR per package from every sync workflow

[ryanrhughes]

All three bot lanes put many packages into one batch PR, so one failing build held back everything else (#788 for four days, #837 now). This PR gives every lane one auto-merging PR per package, so the open PRs are the failures. It also fixes why omarchy-dev and omarchy-settings-dev were slow to follow quattro.

One PR per package, for every lane

• sync-upstream.yml, sync-rebuilds.yml and track-branches.yml each run their sync once.
• .github/scripts/package-pr-groups.sh splits the changed recipes into groups and writes a patch.
• The new reusable package-prs.yml opens or updates one PR per group (auto/<lane>-<package>) and arms auto-merge. fail-fast: false keeps one bad package from affecting the rest.
• Packages pinned from the same upstream branch (omarchy-dev and omarchy-settings-dev) share a PR, because sync-upstream moves them in lockstep.
• Splitting doesn't change what anything builds against. PR builds already build each package in its own job against what edge has published.
• Cleanup: each run closes PRs on its lane's prefix that it didn't refresh and that conflict with master. It also closes the lane's old batch PR (auto/sync-upstream chore: sync upstream releases #837, auto/track-branches). Being unrefreshed alone isn't enough to close a PR, because one of dozens of feeds timing out is routine.

sync-upstream PRs now auto-merge when green

Policy change: the human merge on sync-upstream.yml is gone. The workflow now pushes with PKGS_BOT_TOKEN like the other two lanes. Its builds start without an approval hold, and its PRs auto-merge on green. min_release_age still holds fresh releases back. Removed along with it:

• the approve job
• approve-sync-push.cjs and its tests
• the build-approved self-label
• auto-merge-pr.cjs's exception for auto/sync-upstream

auto_merge: true now only means "checked hourly by the tracker, instead of every 6 hours".

Branch tracker fixes (the omarchy-dev stall)

• A fresh tip held the whole branch. On Oct 9 at 15:29 the tip was 26 minutes old against a 30m min_release_age, so nothing was pinned. The watch now falls back along first-parent history to the newest commit that has cleared the window, never into a merged side branch. Age is measured from clone time, so siblings agree.
• Schedule. 35 */2 * * * actually fired every 6–9 hours. It now runs hourly.
• build-pr.yml applies its queue-instead-of-cancel rule to auto/track-branches-* branches as well.

Verification

• node --test tests/pr-workflow-approval.cjs: 45 pass. New tests cover grouping (the sibling pair shares a PR, everyone else gets their own, no changes means no PRs) and confirm every lane goes through package-prs.yml with the PAT, with no create-pull-request of its own, no build-approved, and no write permissions.
• python3 tests/upstream-watch.py: 37 pass, including fallback, merged-side-branch and nothing-old-enough cases.
• bin/sync-upstream self-test passes, and all workflows parse.
• Against the real quattro branch with a 10h window, both packages fall back to 4.0.0.r6823.g988f44e, the same commit. With 30m they get the tip.
• The cleanup's gh --jq filter, run against live PRs, picks out only legacy chore: sync upstream releases #837 for auto/sync-upstream.
• The reusable workflow itself only runs on GitHub. After merge I'll dispatch sync-upstream.yml to split chore: sync upstream releases #837.