ci: notify downstream repos instantly on release and consume sibling-release dispatches

A new sibling-dependency-update.yml workflow listens for a repository_dispatch event from any
sibling ExaDev package this repo depends on, bumps the named dependency, and opens a PR with
auto-merge requested through the same GitHub App token path already used for Dependabot PRs.

CI still has to pass before the PR merges, and this repo own pnpm-workspace.yaml
minimumReleaseAge gate still applies -- it is respected unconditionally by
pnpm install --frozen-lockfile with no per-package exceptions -- so this closes the gap
between a sibling's publish and a PR being opened here, not the CI-completion floor itself.

Author: Mearman

.github/workflows/sibling-dependency-update.yml

@@ -0,0 +1,65 @@
+name: Sibling dependency instant update
+
+# Triggered the moment a sibling ExaDev package this repo depends on publishes a new version -- the publishing repo own ci.yml sends this repository_dispatch event right after semantic-release completes, instead of waiting for Dependabot own daily scheduled scan to notice. Bumps the named dependency, opens a PR, and requests auto-merge -- the branch push and PR creation use the default GITHUB_TOKEN (an ordinary same-repo operation), but the final merge step mints and uses a GitHub App installation token instead, since GITHUB_TOKEN-authenticated pushes do not cascade into further workflow runs and that merge needs to trigger ci.yml and release normally. This workflow never pushes directly to main -- the PR still only merges once this repo own CI genuinely passes on it. Note: every repo in this family also enforces a minimumReleaseAge pnpm supply-chain gate (see pnpm-workspace.yaml) that CI own pnpm install --frozen-lockfile step respects unconditionally, with no per-package exceptions -- so a same-day sibling release still cannot actually pass CI (and therefore cannot merge) until that gate window has elapsed, regardless of how quickly this workflow opens the PR.
+
+on:
+  repository_dispatch:
+    types: [sibling-released]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump-and-open-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+          cache: pnpm
+      - name: Bump the released dependency
+        env:
+          PACKAGE: ${{ github.event.client_payload.package }}
+          VERSION: ${{ github.event.client_payload.version }}
+        run: pnpm add "$PACKAGE@$VERSION"
+      - name: Check whether anything actually changed
+        id: diff
+        run: |
+          if git diff --quiet -- package.json pnpm-lock.yaml; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Commit and open a PR
+        if: steps.diff.outputs.changed == 'true'
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE: ${{ github.event.client_payload.package }}
+          VERSION: ${{ github.event.client_payload.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          branch="sibling-update/${PACKAGE}-${VERSION}"
+          git checkout -b "$branch"
+          git add package.json pnpm-lock.yaml
+          git commit -m "build(deps): bump ${PACKAGE} to ${VERSION}" -m "Triggered instantly by the ${PACKAGE} release, via repository_dispatch, rather than waiting for the next daily Dependabot scan."
+          git push origin "$branch"
+          pr_url=$(gh pr create --title "build(deps): bump ${PACKAGE} to ${VERSION}" --body "Automatic dependency bump triggered instantly by the ${PACKAGE} release." --base main --head "$branch")
+          echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
+      - name: Generate a token for the merge
+        if: steps.diff.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: "4473709"
+          private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}
+      - name: Enable auto-merge
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh pr merge --auto --rebase "${{ steps.pr.outputs.pr_url }}"