Small fixes from #39–#41; uploads without tokens

[Tobias-Fischer]

Replaces #42, which GitHub closed when main's history was rewritten into topic commits; same branch, rebased (the change is identical).

Takes the parts of @tdejager's #39, #40 and #41 that fix real problems on main, kept small (see the review comments there), and removes the upload tokens.

From #39

• automerge: decides by the label the PR has now, since labeled/unlabeled events can arrive out of order. It also refuses to turn on without the bot app or PAT, because a merge made with GITHUB_TOKEN doesn't start the build workflow. A per-PR concurrency group is added too.
• Locked installs: CI uses locked: true instead of frozen, so a lock file that doesn't match pixi.toml fails up front.
• Generation: one build-branch generation per distribution at a time (generate-<distro> concurrency group). Two quick merges no longer push build branches in parallel.
• check-patches: now also checks shared/patch. As in vinca, a distribution's patches for a package replace the shared ones. Until now, ros2-swri-serial-util.patch was never checked.

From #40

• rs check accepts build_number: 0 (what new-distro writes) and an empty migration list.
• The pinning renders migrations: [].
• update-pinning fails when render-pinning fails.

From #41 (import_distro.py)

• With --distro, ros-<source>-* names are converted using the source distribution.
• Optional files the old repository no longer has are removed on re-import.
• ci.yaml is kept on re-import.

Uploads without tokens

• prefix.dev uploads use trusted publishing (OIDC) only: the PREFIX_API_KEY handling is gone.
• The anaconda.org upload is removed as well: no ANACONDA_API_TOKEN, also stripped from the generated workflows, so no token appears on the command line any more.
• Distributions whose channel is still on anaconda.org (humble, jazzy) are read from there and upload to ROBOSTACK_UPLOAD_CHANNEL. Without it, the upload fails with a clear message.

Left out

• Builds: validate inputs and preserve CI progress #39: the cache epoch (it wipes the PR cache on every push) and release.py.
• Builds: validate inputs and preserve CI progress #39: the Anaconda key passed via env. rattler-build 0.76 doesn't read ANACONDA_API_KEY, so uploads would have lost their credentials. Now moot.
• Maintenance: preserve selection policy and roll back failed updates #40: pins written per distribution (works against one shared pinning), the add-package union, and the rollback machinery.
• Imports: replace distro inputs consistently and use ros2 names #41: the package_name_mode: new switch (it would drop the ros-<distro>-* packages) and the staging/rollback machinery.

Verified

• rs check passes, and actionlint is clean.
• A regenerated jazzy workflow has no token lines and keeps id-token: write.
• Upload dry runs:
  • jazzy without the redirect fails with the message;
  • jazzy with the test channel uploads to tobias-fischer/robostack-distro-test;
  • lyrical uploads to robostack-lyrical.
• Patch discovery layers the directories as vinca does, and lyrical's check now includes the shared patch.

Fixes #27, fixes #29, fixes #32, fixes #36. Part of #26, #31, #34, #38.

🤖 Generated with Claude Code