feat: rework metadata sync to PR + auto-merge

[twcclegg]

Changes

• main's branch protection now requires 3 status checks before any push lands, so the metadata-update automation's direct push (as github-actions[bot], via GITHUB_TOKEN) can never satisfy them — there is nothing to check against until the branch exists. Reworks the metadata sync into two phases, split across two scripts and two workflows.
• lib/github-actions-metadata-update.sh (same trigger: daily schedule / manual dispatch) now pushes to a metadata-update/<tag> branch, opens a PR against main, and enables auto-merge, instead of committing straight to main and creating the release itself. A guard skips opening a duplicate PR if one is already open for the same tag. The pre-commit dotnet build/test step is dropped — the PR's own required checks (full TFM matrix, CodeQL, coverage) run the same build and tests more thoroughly, so running them again here was redundant.
• lib/finalize-metadata-release.sh, run by the new .github/workflows/finalize_metadata_release.yml on pull_request: closed (filtered to a merged metadata-update/* PR opened by github-actions[bot]), tags the merge commit, creates the GitHub release, and dispatches the NuGet publish — the second half of what the update script used to do inline.
• lib/github-release-helpers.sh factors out the pieces both scripts share (logging, the authenticated ghApi wrapper, createRelease, dispatchPublish) so neither carries its own copy.
• Workflow permissions move with the responsibilities: create_new_release_on_new_metadata_update.yml trades actions: write for pull-requests: write (PR + auto-merge, no longer dispatching publish_nuget.yml itself); finalize_metadata_release.yml holds contents: write and actions: write for the release and dispatch.
• README.md and CLAUDE.md are updated to describe the new PR-based flow.

Testing

• shellcheck -x -S warning and bash -n on all three scripts — clean.
• YAML-parsed both workflow files.
• Dry-run of the updated github-actions-metadata-update.sh against this repo (fails only on this sandbox's known block on raw curl to api.github.com — the same failure the unmodified script would hit here, unrelated to this change).
• Full end-to-end run of both scripts against a scratch git remote with a mocked GitHub API (outside this sandbox's network restriction), covering: the happy path (branch push, PR creation, auto-merge mutation), the duplicate-open-PR guard, graceful degradation when enabling auto-merge fails, both finalize-metadata-release.sh invocation forms (tag and metadata-update/<tag> branch name), input validation rejection paths, and dry-run accuracy.

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.26%. Comparing base (e6829c6) to head (bb0f23f).
⚠️ Report is 51 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #431      +/-   ##
==========================================
- Coverage   87.27%   87.26%   -0.02%     
==========================================
  Files          41       41              
  Lines        3828     3831       +3     
  Branches      978      978              
==========================================
+ Hits         3341     3343       +2     
- Misses        283      284       +1     
  Partials      204      204              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.