feat: fully automatic daily README update via a GitHub App

[bcastets-robotiq]

Problem with the previous mechanism (PR #2)

The daily workflow originally used a fine-grained PAT (README_BOT_PAT) to open the PR as a distinct GitHub identity from github-actions[bot], so that identity could approve the PR — the prToMain ruleset blocks a PR's author from approving it, but not a different actor.

That PAT was never set up: it meant either tying the automation to a specific person's personal account (rotation, ownership and offboarding all become that individual's problem) or standing up a dedicated bot account for one workflow. So the workflow was never functional — a manual trigger failed at Checkout with Input required and not supplied: token.

This PR's fix

The instinct behind PR #2 was right — this genuinely needs a second actor — it just reached for the wrong kind. A GitHub App (robotiq-readme-bot, installed on this repo only) is a second actor that belongs to the org rather than to a person, so there's nothing to rotate when someone leaves.

1. update-readme.yml mints an App installation token and opens the daily PR with it.
2. Because that token isn't GITHUB_TOKEN, test.yml actually runs and the required test check reports.
3. readme-auto-merge.yml approves the PR with GITHUB_TOKEN (github-actions[bot] — a different actor from the App, so not self-approval) and enables auto-merge.
4. Auto-merge completes once test goes green.

This is the same two-actor arrangement that already merges Dependabot's PRs on robotiq.github.io (dependabot-auto-merge.yml), with the App standing in for Dependabot.

Settings required

None. prToMain is unchanged — 1 required approval, test required, bypass_actors: []. Every rule stays enforced against every actor, including the bot.

Credentials are already in place: APP_ID (repo variable) and APP_PRIVATE_KEY (repo secret). The key has been verified to mint an installation token scoped to robotiq/.github and nothing else.

Why the ruleset-bypass approach was abandoned

Earlier revisions of this PR tried to let github-actions[bot] bypass prToMain, first alongside a separate no-bypass requireTests ruleset, then with the test running in-job. Both are dead ends:

• A PR opened with GITHUB_TOKEN never triggers test.yml. GitHub deliberately doesn't create workflow runs from events made with that token, so the required check would sit at "expected — waiting for status" forever and --auto would never fire. (A June 2026 change tightened this further.) This is what killed the requireTests split.
• "GitHub Actions" isn't offered as a bypass actor on this org, so the bypass couldn't be granted at all. The REST API rejects it with Actor GitHub Actions integration must be part of the ruleset source or owner organization.

The App route avoids the question entirely by satisfying the rules instead of exempting anyone from them — a better outcome than the bypass would have been, since the bypass would have exempted the bot from all four rules including the test check.

Other fixes carried in this PR

• EXISTING_PR picked up the literal string "null" from --jq '.[0].url' on an empty list, so [ -n ] always matched, gh pr create was skipped and the merge ran against null. Fixed with // empty.
• Added a concurrency group so a manual workflow_dispatch during the scheduled run can't produce two jobs racing on the same branch.
• Commits are made under the App's bot identity (332551394+robotiq-readme-bot[bot]@users.noreply.github.com) so they're attributed — prToMain sets require_extra_approval_for_unattributed_changes, which would otherwise demand a second approval.
• update-readme.yml's own GITHUB_TOKEN is down to contents: read; the App token does the writing.

Test plan

• All three workflows parse; step lists and job conditions verified
• node --test scripts/*.test.mjs passes (16/16)
• App private key verified to authenticate and mint an installation token scoped to robotiq/.github only
• readme-auto-merge.yml confirmed to have no checkout step (it approves and merges with a write-capable token)
• Trigger update-readme.yml via workflow_dispatch and confirm: App opens the PR → test runs and passes → github-actions[bot] approves → auto-merge completes, with zero manual steps
• Confirm a human PR still requires an approval and a passing test

🤖 Generated with Claude Code

[mbegin-robotiq]

Reviewed the App-based design. Verified: the private key mints an installation token scoped to robotiq/.github only; all three workflows parse; tests pass 16/16; readme-auto-merge.yml has no checkout step; and its actor/branch gate correctly skipped on this PR. prToMain is unchanged — no bypass actors, all rules still enforced.