feat(sync): auto-merge trusted full-catalog sync PRs

[rekram1-node]

Summary

• Mint a GitHub App token (OPENCODE_APP_ID / OPENCODE_APP_SECRET) for sync pushes/PRs so pull_request CI actually runs (unlike GITHUB_TOKEN bot pushes).
• Label every sync PR with automation, model-sync, provider:<id>.
• Trusted full-catalog providers also get sync-automerge and gh pr merge --auto --squash.

Auto-merge allowlist: openrouter, kilo, venice, chutes, ovhcloud, wandb

Repo setup (required before this works)

1. Install the OpenCode GitHub App on anomalyco/models.dev (Contents + Pull requests).
2. Add Actions variable OPENCODE_APP_ID = 1549082 (plaintext) and secret OPENCODE_APP_SECRET (App private key from opencode).
3. Enable Allow auto-merge on the repo.
4. Branch protection on dev: required checks only, or App review bypass if reviews are mandatory.

Test plan

• Confirm App install + secrets on models.dev
• Manually run Sync Model Catalogs for openrouter (or wait for schedule)
• PR opens as App bot, has sync-automerge, auto-merge queued
• After validate CI green, PR squash-merges to dev
• Non-allowlisted provider PR still opens without auto-merge

[github-actions]

Action items

• [medium] [possible mistake] .github/workflows/sync-models.yml (Report changes step) - Check: OpenCode GitHub App installation permissions cover every API operation the workflow performs. Why: The PR body's "Repo setup" lists "Contents + Pull requests," but the workflow calls gh label create, gh pr create --label, and gh pr edit --add-label. Label management uses GitHub's Issues API (POST /repos/{owner}/{repo}/issues/{number}/labels), which requires the "Issues: write" GitHub App permission. Without it, gh label create fails silently (|| true) and gh pr create/gh pr edit fail at the label-adding step, so sync PRs ship without automation, model-sync, provider:<id>, or sync-automerge labels. Action: Add "Issues: write" to the documented App installation permissions (or verify the App's existing grant already covers label operations on PRs).
• [low] [possible mistake] .github/actions/setup-git-committer/action.yml:32 - Check: Git author email matches GitHub's App bot noreply format. Why: The composite action sets user.email to ${slug}[bot]@users.noreply.github.com, but GitHub App bot noreply addresses require the <app-id>+ prefix (<app-id>+<slug>[bot]@users.noreply.github.com). The existing sync-models.yml and ci-fixer.yml both use the prefixed form (41898282+github-actions[bot]@users.noreply.github.com). Without the prefix, pushed commits won't be attributed to the App bot on GitHub. Action: Set the email to ${{ inputs.app-id }}+${slug}[bot]@users.noreply.github.com, since app-id is already a composite action input.

[github-actions]

No actionable findings.