feat: trigger Sourcebot sync after Zoekt merges

[brendan-kellam]

Summary

• react to every pull request merged into the default branch
• mint a narrowly scoped GitHub App token for Sourcebot
• dispatch the merged Zoekt SHA and pull request number to Sourcebot
• avoid checking out or executing pull request-controlled code

Companion receiver: sourcebot-dev/sourcebot#1560

Validation

• parsed the workflow as YAML
• ran git diff --check

Configuration

Requires SOURCEBOT_SYNC_APP_ID and SOURCEBOT_SYNC_APP_PRIVATE_KEY Actions secrets. The app should be installed only on sourcebot-dev/sourcebot with Contents and Pull requests write access.

---

Note

Medium Risk
Uses pull_request_target with repository secrets and a cross-repo GitHub App token; the design avoids PR checkout, but misconfigured secrets or app permissions could affect the downstream Sourcebot repo.

Overview
Adds sync-sourcebot.yml, a new GitHub Actions workflow that runs when a PR is closed and merged into the default branch.

It mints a GitHub App token scoped to sourcebot-dev/sourcebot (via SOURCEBOT_SYNC_APP_ID / SOURCEBOT_SYNC_APP_PRIVATE_KEY) and POSTs a zoekt-pr-merged repository dispatch with the merge commit SHA and Zoekt PR number. The workflow uses pull_request_target and does not check out PR code, so untrusted PR content is not executed while base-repo secrets can still be used for the cross-repo call.

A step summary records that the dispatch was sent.

^{Reviewed by Cursor Bugbot for commit f4b645e. Bugbot is set up for automated code reviews on this repo. Configure here.}