ci(upstream): gate release on merged sync PR

[code-yeongyu]

Summary

• refresh scheduled runs onto latest origin/main before detecting upstream releases
• skip stale PR/release work when another run already merged the upstream SHA
• wait for the real Check and test PR check before merging
• comment the QA evidence run/artifact/files directly on the sync PR
• gate release audit/release on the sync PR being merged by that run

Validation

• actionlint .github/workflows/upstream-agent-merge.yml
• python3 YAML parse
• git diff --check

---

Summary by cubic

Gate upstream releases on the sync PR merged by the same run, and harden the workflow to avoid stale PRs and flaky merges. Adds QA evidence comments and safer branch/CI checks for predictable releases.

• New Features
  • Refresh onto origin/main and exit early if the upstream SHA is already merged.
  • Use run-scoped branches automation/upstream-<tag>-<run_id> to avoid head collisions.
  • Ensure PR uses <owner>:<branch>, push HEAD, and verify it’s ahead of main before proceeding.
  • Wait for the Check and test check to appear, then watch to completion; merge with head SHA match and set merged=true/false.
  • Comment QA evidence (run link, artifact name, upstream SHA, files) on the sync PR, and gate audit/worthy/release steps on merged=true with clearer summary outputs.

^{Written for commit 6df59ad. Summary will update on new commits.}