ci: update PR branches after main changes

[rng1995]

Summary

• add a GitHub Actions workflow that runs after pushes to main and can also be dispatched manually
• enumerate all open PRs targeting main and queue GitHub's update-branch API for eligible repository-hosted head branches
• serialize update runs, use least-privilege write permissions, and report queued/skipped/failed counts
• keep the DCO check compatible by exempting only GitHub-generated merge commits while continuing to require sign-off on contributor commits

Why

Open PR branches fall behind whenever changes land on main. GitHub's update-branch API safely merges the latest base into eligible PR head branches, but its generated merge commits do not contain a DCO trailer. Without the narrow DCO exemption, automatic branch updates would make otherwise valid PRs fail the repository's custom DCO check.

Scope and limitation

The repository GITHUB_TOKEN cannot write head branches stored in contributor forks, so those PRs are explicitly skipped with a workflow notice. At implementation time, 2 of 39 open PRs used repository-hosted branches; the other 37 used forks. No personal token or repository secret is introduced.

Validation

• parsed both changed workflow files as YAML
• syntax-checked both embedded Bash scripts
• ran git diff --check
• exercised the PR enumeration query read-only against all 39 current open PRs
• verified DCO classification for a GitHub-generated merge, an unsigned contributor merge, and a signed contributor commit