feat: add automated upgrade workflow for overlays

.github/workflows/upgrade.yml

@@ -0,0 +1,46 @@
+name: Upgrade
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.sha }}
+  cancel-in-progress: true
+permissions:
+  contents: write
+  pull-requests: write
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Upgrade Overlays
+        run: ./scripts/upgrade-overlays.sh all
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.PAT_TOKEN }}
+          commit-message: 'chore: upgrade overlays'
+          title: 'chore: upgrade overlays'
+          body: Automated overlay upgrade
+          branch: chore/upgrade-overlays
+          delete-branch: true
+  upgrade-check:
+    if: always()
+    needs:
+      - upgrade
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Alls Green
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}