Make bot-created release metadata PRs satisfy protected required checks automatically

[ShalomMaman]

Context

The protected Pilot 0.5.4 publication workflow built, signed, verified, drilled, and published the exact release successfully. It then opened metadata PR #67 and explicitly dispatched android-ci.yml on the metadata commit. That dispatched verify job passed, as did CodeQL, but GitHub did not count the workflow-dispatch check toward the Pull Request required-check rollup. Auto-merge remained BLOCKED even though the commit check API showed success.

The documented recovery path was used: the release was already public, PR #67 changed only updates/pilot/latest.json, the signed envelope and all checks were verified, and an administrator completed the squash merge. The parent publication workflow then verified the active public metadata and finished successfully. The active channel was fail-closed throughout; it remained on 0.5.3 until the manual merge.

Goal

Restore the intended one-dispatch publication experience without weakening branch protection or the exact-artifact release gates.

Acceptance criteria

• A bot-created metadata PR receives a verify check that GitHub recognizes as satisfying the protected main required check.
• Auto-merge completes without an administrator bypass after that recognized check and CodeQL succeed.
• The release remains a draft until metadata CI passes, and latest.json is still activated only after the immutable release is public.
• A failing or missing metadata check leaves the previous signed channel active and the new release unpublished or safely orphaned according to the recovery runbook.
• Add a workflow/tooling regression test that distinguishes a PR-associated required check from a workflow-dispatch-only check.
• Rehearse the fixed path without private material where possible, then prove it on the next protected pilot publication.

Non-goals

• Do not remove the verify branch-protection requirement.
• Do not allow the release workflow token to bypass failed checks.
• Do not move signing secrets outside the protected pilot-release environment.

Evidence

• Publication run: https://github.com/ShalomMaman/android-lockdown-dpc/actions/runs/31953509746
• Metadata PR: Publish pilot-v0.5.4 update metadata #67
• Public release: https://github.com/ShalomMaman/android-lockdown-dpc/releases/tag/pilot-v0.5.4

Hebrew summary

בריליס 0.5.4 כל בדיקות החתימה וה־CI עברו, אך GitHub לא ספר בדיקת workflow_dispatch כבדיקת החובה של ה־PR ולכן Auto-merge נתקע. הערוץ נשאר בטוח על הגרסה הקודמת עד שמוזג ידנית. הכרטיס דורש להחזיר פרסום אוטומטי בלחיצה אחת בלי להחליש את הגנת הענף או את אימות הריליס.