Add a scheduled GitHub Action workflow that runs the make update-upstream script, detects if the submodule SHA changed, and opens a PR against main if so. PR should include: commit range, changelog snippet, and link to upstream changes. Enable GitHub auto-merge on the PR so it merges automatically when all Tekton/Konflux status checks pass. Support workflow_dispatch for manual triggers.