ci: add back-merge main -> develop workflow

.github/workflows/backmerge.yml

@@ -0,0 +1,59 @@
+name: Back-merge main -> develop
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: backmerge
+  cancel-in-progress: false
+
+jobs:
+  open-backmerge-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Skip if develop already contains main
+        id: check
+        run: |
+          if git merge-base --is-ancestor origin/main origin/develop; then
+            echo "needs_pr=false" >> "$GITHUB_OUTPUT"
+            echo "develop already contains main; nothing to do."
+          else
+            echo "needs_pr=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Open or update back-merge PR
+        if: steps.check.outputs.needs_pr == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          MAIN_SHA="$(git rev-parse --short origin/main)"
+          MAIN_SUBJECT="$(git log -1 --format='%s' origin/main)"
+
+          EXISTING="$(gh pr list --head main --base develop --state open --json number --jq '.[0].number')"
+          if [ -n "$EXISTING" ]; then
+            echo "PR #$EXISTING already open for main -> develop; it will auto-update with the new push."
+            exit 0
+          fi
+
+          gh pr create \
+            --base develop \
+            --head main \
+            --title "chore: back-merge main into develop" \
+            --body "Automated back-merge of \`main\` into \`develop\`.
+
+Latest commit on main: \`$MAIN_SHA\` - $MAIN_SUBJECT
+
+Triggered by push to \`main\` in workflow \`${{ github.workflow }}\` run \`${{ github.run_id }}\`.
+
+Merge this PR (or enable auto-merge on it) to keep \`develop\` in sync with the latest release commit on \`main\`. Resolve any conflicts manually before merging.
+
+> **Note on GPG**: the merge commit GitHub creates when you click \"Merge pull request\" is signed by \`web-flow\`. The locksmith \`make verify\` GPG gate already ignores web-flow merge commits, so this back-merge will not break verification on \`develop\`."