chore: trim the automation

[Vatoth]

Follow-up to #21, which was merged before this landed on the branch.

• Compresses the pins drift check from 30 lines to 20. Every case it catches is unchanged, re-verified against a deliberately broken tree: the two golangci-lint versions disagreeing, the two FROM golang: lines disagreeing, go.mod asking for a newer Go than the base image, and a base image newer than the go directive still passing (legal, and stops a Dependabot base-image bump from blocking its own PR). The safety net that fails when a pin cannot be read at all — rather than comparing two empty strings and passing — is also covered by tests.
• Trims the comment blocks in automerge.yml and sync-pins.yml.

Why gh pr merge --auto still isn't used

Recorded in the workflow now, because it is not obvious and cost some digging:

• Auto-merge only holds a pull request for checks that branch protection marks as required. main has none, so GitHub refuses to arm it (Pull request is in clean status) and the documented workaround — falling back to a plain gh pr merge — merges immediately, build or no build.
• The obvious simplification, pull_request_target + gh pr checks --watch, deadlocks: pull_request_target runs appear in gh pr checks, so it waits on itself.

So the workflow_run trigger and its guards are load-bearing, not ceremony. If you'd rather have the six-line version, someone with admin needs to turn on Allow auto-merge and add main + pins as required checks on main — I don't have admin here (PATCH /repos/upsun/vinego returns 404). Say the word and I'll swap it.

🤖 Generated with Claude Code