ci: keep open PR branches up to date with main automatically

[cuttlefisch]

Four PRs went stale against main simultaneously today, each then needing a
manual back-merge plus a full CI re-run before it could land. This removes the
manual step.

Why they go stale

main's protection sets required_status_checks.strict = true — a PR must be up
to date with the base to merge. That is the right setting; it is what stops two
independently-green PRs from combining into a broken main. But it means every
merge to main invalidates every other open PR.

Done by hand the cost is paid twice: once in CI minutes, and once in the latency
between "CI went green" and "somebody noticed and pushed the back-merge". With
several PRs open the second cost dominates, and a PR discovers it is stale at
merge time — the worst moment to find out.

What this does

On every push to main, bring every open non-draft PR forward. Combined with
auto-merge (now enabled repo-wide), a PR that is green and approved lands without
anyone watching it.

Two bugs the obvious version would have shipped

Both were found by testing against the live API rather than reasoning about it.

1. mergeStateStatus is computed lazily. The first query for a PR kicks off
the computation and returns UNKNOWN; only a later query sees the truth. A
workflow keyed on state == "BEHIND" would therefore skip exactly the PRs it
exists to fix, on precisely the run where main just moved and nothing has been
recomputed — silently, looking like a successful no-op run. Observed live on this
repo minutes before writing it: two PRs reported mergeable: UNKNOWN alongside a
fully-populated check list. Fixed by reading behind_by from the compare API,
which is derived from the commit graph and correct on first read.

2. gh api writes its error body to stdout. On a 404 — deleted branch,
fork-side head — $behind holds {"message":"Not Found",...}, not an empty
string. An emptiness check alone passes that straight to [ "$behind" -eq 0 ],
which errors and, being false, falls through to attempting an update on a branch
that does not exist. Fixed with a case guard requiring an actual integer; all
four input shapes (5, 0, empty, error-JSON) unit-tested.

Deliberate non-behaviours

• Never force-pushes. gh pr update-branch merges, so nobody's local clone
  has history rewritten under it.
• Skips drafts. A draft is not racing to merge; updating it would burn a CI
  run per push to main for nothing.
• One conflict does not fail the run. A merge conflict is the author's to
  resolve, and must not hide the outcome for every other PR. Each result goes in
  a per-PR summary table with a totals line.
• Concurrency group cancels older runs. Several merges in quick succession
  would otherwise start overlapping runs racing on the same branches, doubling
  the CI they trigger.

Also enabled allow_auto_merge on the repository, which was off — that is what
lets a green PR land without a manual merge command.

🤖 Generated with Claude Code