Listens for repository_dispatch event_type=upstream-bump from libfossil's release workflow. Validates payload (repo/module_path/version regex), checks for existing open PR (idempotency), retries go get up to 3 times to absorb GOPROXY propagation lag, opens a chore PR via github-actions[bot].

Falls back to workflow_dispatch with the same inputs for manual recovery.

EXPECTED_REPO=libfossil; EXPECTED_MODULE=github.com/danmestas/libfossil. Other dispatch sources are silently ignored. Mirrors the production-tested shape from bones #90. check-in: 0e93a687f0 user: [email protected] tags: trunk