ci(sync): drop auto-merge step; bot PRs await codeowner review

Auto-merge was failing with `Auto merge is not allowed for this
repository (enablePullRequestAutoMerge)` even after enabling
`allow_auto_merge` at the repo level. Root cause: branch protection
requires codeowner review, the github-actions[bot] cannot bypass
that requirement (GitHub's API silently rejects the
`github-actions` slug from `bypass_pull_request_allowances.apps`),
and there are no other code owners.

Two paths from here, both deferred to a follow-up:

  1. Provision a GitHub App owned by amacsmith with Contents:Write +
     PullRequests:Write permissions, install on the repo, add its
     slug to the bypass allowlist. The sync workflow uses
     actions/create-github-app-token to mint a token and the
     enable-pull-request-automerge step uses it. Most secure.
  2. Mint a fine-grained PAT for amacsmith with the same scopes,
     store as secrets.BOT_PAT, use directly. Easier, less granular.

Until either lands, the daily sync workflow still opens / updates a
bot/sync PR; a codeowner merges it manually. Branch-protection
remains intact (codeowner review required) — Scorecard
Branch-Protection score stays at 7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: amacsmith

.github/workflows/sync.yml

@@ -157,14 +157,14 @@ jobs:
             site/badges
             site/.well-known
 
-      # pin: v3.0.0 -- peter-evans/enable-pull-request-automerge
-      - name: Enable auto-merge
-        if: steps.cpr.outputs.pull-request-number
-        uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
-          merge-method: squash
+      # Auto-merge intentionally NOT enabled here. GitHub's
+      # branch-protection bypass allowlist does not accept the built-in
+      # `github-actions` app slug, so the bot's PR cannot satisfy
+      # `require_code_owner_reviews`. The PR sits open until a
+      # codeowner (amacsmith) reviews and merges manually, OR until we
+      # wire a custom GitHub App or fine-grained PAT through
+      # `secrets.BOT_PAT` and re-enable the enable-pull-request-automerge
+      # step using that token.
 
       - name: Trigger pages redeploy (best-effort)
         if: steps.diff.outputs.changed == 'true'