ci: automatically track verified ASAPPlanner main

[zzylol]

Why

Keep backend main automatically aligned with ASAPPlanner main without landing incompatible Planner changes.

Before this PR

Four workspace Planner dependencies and Cargo.lock stay at 10d93846 until someone updates them manually.

After this PR

The daily/manual workflow extracted unchanged from #765 resolves Planner main, pins all four dependencies to the same SHA, refreshes Cargo.lock, and maintains one update PR. The existing MVP CI runs with --locked. A successful run for the exact update head and unchanged main baseline triggers a squash merge, subject to branch protection. Failed updates stay open.

The dependency pin stays at the current main revision. Trialing Planner main 2ec3fc80 compiled but failed 51 of 425 control-plane tests. #761 owns the corresponding Planner #455 evidence/cost semantic adaptation; this PR deliberately does not duplicate it.

How

The script scripts/sync-asapplanner-main.sh and .github/workflows/sync-asapplanner-main.yml are identical to #765. Keeping their paths and automation branch identical avoids duplicate schedulers when #765 lands. This lets synchronization reach main independently of the query-DAG stack.

Reuse ASAP_CI_REPO_TOKEN for dependency access and PR creation so pull_request CI actually triggers. A separate workflow_run handler, using GITHUB_TOKEN, merges only the same-repository automation/sync-asapplanner-main PR, and only when its diff contains Cargo.toml/Cargo.lock. It never checks out PR content. No repository-wide auto-merge setting change is needed.

Verification

• Four tests execute the shared shell script with mocked Git/Cargo: all pins and lock-update arguments agree; invalid revisions and unexpected layouts leave the manifest untouched; Cargo failure propagates.
• The shared shell script resolves current upstream main successfully; bash syntax checks pass.
• actionlint and workspace formatting pass.
• Trial upgrade to Planner 2ec3fc80: workspace check and Clippy pass, but control-plane tests report 374 passed / 51 failed. This demonstrates why semantic upgrades must be gated on the full tests, not compilation alone.
• Eight mocked merge-handler scenarios pass in V8: valid update merges; stale head/main, foreign repository, draft, unexpected/empty diff, and missing PR do not.
• Final unchanged dependency pin: workspace check, strict all-target Clippy, and cargo test --workspace --locked pass: 1,773 passed, 0 failed, 2 pre-existing ignored tests. Process E2E is included.
• GitHub MVP CI passed on e34cf8c: https://github.com/ProjectASAP/ASAPQuery-backend/actions/runs/35781665373

Limitations and follow-up

Schedules start after this PR lands on main and GitHub may delay scheduled runs. ASAP_CI_REPO_TOKEN already exists, but its secret value/scopes cannot be inspected: it needs private dependency read plus backend Contents/Pull requests write permissions. If those permissions are missing, the update workflow fails visibly. Upstream semantic/API incompatibilities require a follow-up fix; they are not auto-merged. In particular, latest Planner main cannot currently land on backend main until the #761 adaptation (and its stack) is ready.

Human review — do not complete with an agent

• The MVP boundary is correct.
• New conceptual layers or public interfaces are necessary.
• The before/after description matches the intended product behavior.
• Human reviewer:
• Decision and rationale: