devops(ci): run CI on the upstream branch itself so its PR can merge

[b1zya]

The PR the playwright-cli watch opened after #7 (b1zya/patchright-cli#8) is BLOCKED with zero checks.

Cause

The upstream workflows ran CI as a reusable ci.yml call. A called workflow attaches its check runs to the caller's commit, which is main, under test / <os> / node <n>. Confirmed on the earlier watch run: the check runs sit on 544960b (main), and the tracking commit has none. The PR itself is opened with the workflow token, which starts no pull_request CI. So the PR head never gets the <os> / node <n> checks the main ruleset requires. That also means a safe patchright-core roll could never merge automatically: the merge step would only leave its "could not merge" comment.

Fix

• ci.yml: workflow_dispatch replaces workflow_call (nothing else called it), and the ref input and checkout override go with it.
• New composite .github/actions/ci-on-branch: dispatches ci.yml on the pushed branch, finds the run by its commit, and waits for it. workflow_dispatch is the one event the workflow token may start. Its check runs land on the branch head under the plain job names.
• upstream-roll.yml and upstream-playwright-cli.yml: the test job is gone; pull-request runs the composite, then everything works as before. The CI result (now with a link to the run) goes into the PR body, the tests-failed label and the safe merge. A final step fails the run when CI did not pass, so the scheduled-run notification still fires. Both workflows get actions: write to dispatch.
• The wait polls gh run view instead of gh run watch, which also reads check annotations and would need a checks permission these workflows do not grant.
• roll.md documents the coupling: the ruleset's required checks have to change with the matrix in ci.yml.

No repository setting changes: the workflow merges a safe PR itself once its checks are green, so "Allow auto-merge" stays off.

Verification

• every run: block passes bash -n, the YAML parses, npm run check clean
• the dispatch and the run lookup ran for real against this branch: run 36909291708, workflow_dispatch on fix-upstream-pr-checks at a0c4dc6, found by commit
• end to end after merge: re-dispatch the watch; it re-pushes track-playwright-cli_b85c7a7, CI runs on it, and chore: track microsoft/playwright-cli #8 gets its checks

🤖 Generated with Claude Code