ci: skip update-tools on the bot's own synchronize pushes (#1189)

The commit-all-changes job pushes with a GitHub App installation token
so downstream workflows (notably ci.yml) re-run on the bot's commit.
That deliberate behavior also re-triggers update-tools.yml itself,
producing a loop where each run rewrites metadata.last_updated and
commits the timestamp change, which fires another synchronize event.

Guard detect-changes against pull_request synchronize events whose
sender is toolhive-release-app[bot]. Other triggers - PR opened, human
pushes, workflow_dispatch - still run as before, and ci.yml is
unaffected so the bot's commit is still validated end-to-end.

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rdimitrov

.github/workflows/update-tools.yml

@@ -94,8 +94,14 @@ jobs:
     name: Detect Changed Servers
     runs-on: ubuntu-latest
     needs: [security-check]
+    # Skip on the bot's own synchronize pushes: commit-all-changes pushes with
+    # an app token, which (unlike GITHUB_TOKEN) re-triggers pull_request events.
+    # Without this guard the workflow re-runs on its own commit and loops.
     if: |
       always() &&
+      !(github.event_name == 'pull_request' &&
+        github.event.action == 'synchronize' &&
+        github.event.sender.login == 'toolhive-release-app[bot]') &&
       (github.event_name == 'workflow_dispatch' ||
        (github.event_name == 'pull_request' && needs.security-check.outputs.should-run == 'true'))
     outputs: