fix(ci): open a release PR instead of pushing to protected main

[mrveiss]

Thinking Path

The Sync Dev_new_gui → main workflow has never completed. Two independent blockers, discovered one behind the other:

Blocked on divergence — the 2026-08-05 run:

::error::main has 4 commit(s) not in Dev_new_gui. Resolve divergence manually first.

Fixed by #13951, which merged main's history back into the trunk (zero content change).

Then blocked on branch protection — today's run, having passed the divergence gate:

remote: error: GH006: Protected branch update failed for refs/heads/main.
 ! [remote rejected] origin/Dev_new_gui -> main (protected branch hook declined)

main requires two status checks — No open blocks-merge issues reference this PR and No commit trailers. A direct push moves the branch to a commit that carries neither, so the hook declines it. That is not a misconfiguration to work around; it is the protection doing its job. The push could never have succeeded, which is why main sat 41 commits behind for days with no visible signal — a dispatch-only workflow failing silently is invisible unless someone goes looking.

So the step routes through a PR instead, which is what lets the required checks run against the release head. #13816 did exactly this by hand on 2026-08-09 — this makes the builtin do what the human already had to.

What Changed

.github/workflows/sync-main-to-dev.yml only.

• The push step becomes: force-update a dedicated release-sync-main branch to the trunk, then open a PR into main
• If a sync PR is already open, refresh the branch and report it rather than creating a duplicate
• The divergence guard is unchanged, and its inline expansions moved to env: (it read if [ "0" != "0" ] in the log — correct, but interpolated rather than passed)
• The header comment no longer says the workflow pushes to main, and the step carries the GH006 output so the next reader does not rediscover it

Still workflow_dispatch-only, still requires typing release. Merging the PR is the release; this only makes the PR appear.

Verification

The run: block was extracted from the YAML and exercised with git and gh stubbed — a workflow edit that merely looks right is what produced the original bug.

Case	Result
main diverged (BEHIND=3)	::error::main has 3 commit(s) not in Dev_new_gui — refuses, unchanged
no sync PR open	pushes release-sync-main, creates the PR, writes url= to $GITHUB_OUTPUT
sync PR already open	refreshes the branch, reports #4242, creates no duplicate

The PR body is written via a file and de-indented, so the YAML block indentation does not leak into it:

$ grep -c "^ " /tmp/sync-pr-body.md
0

$ python -c "yaml.safe_load(open('.github/workflows/sync-main-to-dev.yml'))"
YAML valid

Not verified end to end: the workflow itself has not been re-dispatched against this change — it can only be tested by running it, and doing that from a branch would open a real release PR. Worth dispatching once this lands.

Refs #2445

Model Used

Opus 5