ci: call the central auto-merge sweep instead of carrying a copy

[catomean]

auto-merge-sweep.sh was copied into 22 repos and drifted into 8 distinct versions, 245–404 lines. Three independently grew different fixes for real outages, and each fix reached only the repo that wrote it:

Variant	Fix only it had
evig	infra-failure detection + re-run — an Actions incident left main failure with no failed job; 11 PRs stranded ~14h
fleetcrown	deadlock naming — a red base with the repairing PR queued looked identical to "nothing to merge"
the other 19	neither

Nothing could carry a fix across, so every repo waited to hit each outage itself. This repo now calls the canonical sweep in maonakamoto/dotfiles; the local copy is deleted.

The canonical is a union, not "the biggest file"

It is built on the variant ten repos were already running, with the two outage fixes spliced in — not on the longest one. The 404-line variant lacks the step-summary reporting the 296-line one has, so picking by size would have silently deleted working behaviour. The merge was 106 insertions, zero deletions: nothing can be lost by adopting it.

What stays local, and why

The triggers. workflow_run must name the CI workflow exactly, and that name differs across the fleet — so this file is now settings, not logic.

Two details that are silent when wrong

Both found by piloting a real repo rather than reasoning about it:

• rearm_workflows is space-separated. The sweep word-splits it; a comma becomes one bogus token, every dispatch fails, and the only symptom is nothing deploys — while the sweep still exits 0 and reports a successful merge.
• permissions are declared on the caller too. A called workflow's token is capped by what the caller grants, so relying on the callee's block alone can hand it a read-only token; the sweep would then merge nothing while exiting 0 — indistinguishable from having nothing to merge.

Verification before this rollout

The canonical ran end to end in dotfiles' own CI, and the reusable-workflow path ran end to end in the pilot repo (s-ink) — job sweep / sweep green, log confirming it resolved the base and swept.

🤖 Generated with Claude Code