Refactor sync branch naming and publish version resolution to support ordered PR merges

Several upstream releases had accumulated as pending sync PRs that could not
be merged in order: the publish workflow resolved the build version by fetching
the current latest upstream tag, so merging an older PR would build the wrong
version against mismatched code, causing bin/build.sh to exit with code 255.
Branch names also used the date rather than the release tag, so the
duplicate-PR guard fired per day instead of per version, producing multiple
open PRs for the same release.

Renames sync branches from sync/upstream-<date> to sync/upstream-<tag> so
the already-open check correctly deduplicates across days, and changes the
publish workflow to extract VERSION from the branch name instead of fetching
the latest upstream tag, so each PR merge builds the version it actually
contains and older PRs can be merged in sequence.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: trevorgowing

.github/workflows/teal-docker-publish.yml

@@ -57,7 +57,7 @@ jobs:
             BRANCH="${{ github.event.pull_request.head.ref }}"
 
             if [[ "$MERGED" == "true" ]] && [[ "$BRANCH" =~ ^sync/upstream- ]]; then
-              VERSION=$(gh api repos/metabase/metabase/releases/latest --jq '.tag_name')
+              VERSION="${BRANCH#sync/upstream-}"
               echo "should_build=true"  >> "$GITHUB_OUTPUT"
               echo "version=$VERSION"   >> "$GITHUB_OUTPUT"
               echo "Upstream-sync PR merged — building $VERSION"

.github/workflows/teal-sync-upstream-release.yml

@@ -56,8 +56,7 @@ jobs:
         id: status
         run: |
           TAG="${{ steps.upstream.outputs.release_tag }}"
-          DATE=$(date +%Y-%m-%d)
-          BRANCH="sync/upstream-$DATE"
+          BRANCH="sync/upstream-$TAG"
 
           if git merge-base --is-ancestor "$TAG" HEAD; then
             echo "result=already-synced" >> "$GITHUB_OUTPUT"