Disable dependabot and auto_merge, add cleanup guard for upstream syncs

.github/workflows/cleanup-upstream.yml

@@ -0,0 +1,34 @@
+name: Cleanup upstream files
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/dependabot.yml"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: cleanup-upstream
+  cancel-in-progress: true
+
+jobs:
+  remove-dependabot:
+    name: Remove upstream dependabot config
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+
+      - name: Remove dependabot.yml if present
+        run: |
+          if [ -f .github/dependabot.yml ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git rm .github/dependabot.yml
+            git commit -m "chore: remove upstream dependabot.yml (rely on upstream)"
+            git push
+          fi

.github/workflows/rebase-upstream.yml

@@ -0,0 +1,26 @@
+name: Rebase upstream
+
+on:
+  schedule:
+    # Run daily at 03:00 UTC
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync-upstream:
+    name: Sync main from upstream
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Sync fork with upstream
+        uses: tgymnich/fork-sync@e905b254d56ebb367514cd05fa96bf7516bd2a5a # v2.0.10
+        with:
+          base: main
+          head: main
+          merge_method: merge
+          auto_merge: false
+          pr_title: "chore: merge upstream main"