REQ-CI-001: A merge to main opens or updates a single PR on the consumer bumping its pinned reference

When a commit lands on main, CI opens a pull request on fangorn/anvil moving its pinned ex_git_objectstore reference to that commit, so the change goes through Anvil's review and full test suite instead of sitting unconsumed. It triggers only on a real merge to main, established by comparing the checked-out SHA against origin/main rather than by matching the branch name, which is a detached HEAD in CI and has matched unrelated branches by substring before. It is idempotent: repeated merges update the one open pin-bump PR in place rather than accumulating a pile of them. It never merges and never deploys — Anvil's CI is the gate and a human merges. Failing to open the PR fails the job loudly rather than skipping.