Add PR build testing and auto-merge for dependency PRs

[compscidr]

Summary

• New build.yml workflow: builds all JDK variants from matrix.json on every PR (push: false), gated by a single stable check named All builds passed
• check-sdk-updates.yml now uses the AUTOMERGE_PAT secret (default GITHUB_TOKEN PRs never trigger workflows) and enables auto-merge on its PRs
• Design: docs/superpowers/specs/2026-08-04-pr-build-automerge-design.md

Follow-up (manual, after this merges)

• A branch ruleset on main requires All builds passed (created via API as part of this work)
• @compscidr must create a fine-grained PAT (this repo only; contents: write, pull-requests: write) and save it as repo secret AUTOMERGE_PAT

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR introduces PR-time container build verification and enables auto-merge for dependency-update PRs so broken SDK/JDK bumps are caught before merging and deployment.

Changes:

• Adds a new PR workflow (build.yml) that builds the container across all JDK variants and publishes a stable gate check named All builds passed.
• Updates check-sdk-updates.yml to require and use AUTOMERGE_PAT, and enables GitHub auto-merge on the workflow-generated PRs.
• Adds/records design + implementation plan documentation for the workflow/ruleset approach.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/build.yml	New PR build matrix workflow with stable “All builds passed” gate check.
.github/workflows/check-sdk-updates.yml	Uses AUTOMERGE_PAT and enables auto-merge for the SDK/JDK update PR.
docs/superpowers/specs/2026-08-04-pr-build-automerge-design.md	Design spec for PR builds + auto-merge + ruleset.
docs/superpowers/plans/2026-08-05-pr-build-automerge.md	Implementation plan describing the workflow/ruleset changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.