ci: open a tracking issue with an agent playbook when a new upstream version ships

[avifenesh]

Summary

• Extract CFBundleShortVersionString from the upstream DMG during scheduled builds
• Open a tracking issue when a new version is detected, deduplicated by version number
• Include comprehensive agent playbook for addressing the new version
• Provide direct links to workflow run, artifacts, and DMG metadata

Motivation

The daily upstream-build workflow validates that the current patch set applies cleanly to the latest upstream DMG, but when a new version ships, there's no automated signal or guidance for maintainers. This PR adds scheduled version-detection and creates an issue containing:

1. Version metadata: CFBundleShortVersionString, DMG SHA-256, HTTP headers, detection timestamp
2. Workflow context: Direct links to the run and artifacts (including patch-report.json)
3. Agent playbook: Step-by-step guide for downloading the DMG, running the intelligence report, building against the new version, fixing patch matchers when upstream code shapes change, validating fixes, running tests, and opening PRs

The playbook documents repo conventions (keep old shapes, add new branches, idempotent patches, graceful warnings) and references AGENTS.md, scripts/patches/core/README.md, and other source-of-truth files.

Issues are deduplicated by the upstream-version label and version number in the title. The workflow only creates issues on scheduled runs when a valid version is extracted (skips unknown versions).

Complementary to PR #737

This PR complements the DMG intelligence report work in PR #737:

• Expand DMG intelligence for Linux parity drift #737 adds deep analysis tooling: platform gate classification, protected surface inventory, raw asar extraction, parity patch preflight, and release decision tables
• This PR adds scheduled version-detection + issue automation to make that tooling actionable when a new version ships

Both work together: the playbook references the intelligence report as a discovery step, and the issue links to the workflow artifacts containing the patch report.

Validation

• YAML syntax validated with Python yaml.safe_load
• Issue creation logic follows computer-use-sync-reminder.yml pattern: label creation, deduplication by label + title, github.rest.issues.create
• Version extraction reuses existing appBundleVersion() helper from scripts/lib/build-info.js
• Playbook documents repo conventions from AGENTS.md and patch descriptor contract from scripts/patches/core/README.md
• Job-level issues: write permission scoped to the single job that needs it
• Schedule-only trigger prevents issue creation on PR/push/workflow_dispatch runs
• Deduplication prevents duplicate issues for the same version on subsequent runs

Testing Plan

The workflow will be validated on the next scheduled run (daily at 6:30 UTC). Expected behavior:

1. If the upstream version has not changed, no issue is created (deduplication check passes)
2. If a new version is detected, an issue is created with version metadata, workflow links, and the full playbook
3. If the version cannot be extracted, no issue is created (skips unknown versions)

The issue creation can also be tested by triggering a manual workflow_dispatch run, observing that no issue is created (schedule-only guard), then temporarily removing the if: github.event_name == 'schedule' condition and re-running.

[avifenesh]

The failing Build App Against Upstream DMG check is pre-existing: main has been failing the same job since the scheduled run at 2026-07-11 05:21 UTC (new upstream DMG shipped with webview chunk drift — app-server manager signals bundle and friends). See https://github.com/ilysenko/codex-desktop-linux/actions/workflows/upstream-build-app.yml. Working on a separate PR to fix the new-version drift.

[ilysenko]

Thank you for proposing and implementing scheduled upstream issue automation. We incorporated the idea into #834 and extended it with SHA-256 identity, supersede/reopen behavior, accepted-version cleanup, and stale-run protection. I am closing this PR as superseded by #834.